Add single and multi-level pointer parameters and return value test
coverage for BPF trampolines. Includes verifier tests for single and
multi-level pointers. The tests check verifier logs for pointers
inferred as scalar() type.
Signed-off-by: Slava Imameev <slava.imameev@crowdstrike.com>
---
net/bpf/test_run.c | 17 +++++
.../selftests/bpf/prog_tests/verifier.c | 2 +
.../bpf/progs/verifier_ctx_ptr_param.c | 68 +++++++++++++++++++
3 files changed, 87 insertions(+)
create mode 100644 tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 56bc8dc1e281..14c4814a7dab 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -567,6 +567,23 @@ noinline void bpf_fentry_test_sinfo(struct skb_shared_info *sinfo)
{
}
+noinline void bpf_fentry_test_ppvoid(void **pp)
+{
+}
+
+noinline void bpf_fentry_test_pppvoid(void ***ppp)
+{
+}
+
+noinline void bpf_fentry_test_ppfile(struct file **ppf)
+{
+}
+
+noinline struct file **bpf_fexit_test_ret_ppfile(void)
+{
+ return (struct file **)NULL;
+}
+
__bpf_kfunc int bpf_modify_return_test(int a, int *b)
{
*b += 1;
diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
index 8cdfd74c95d7..bcf01cb4cfe4 100644
--- a/tools/testing/selftests/bpf/prog_tests/verifier.c
+++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
@@ -115,6 +115,7 @@
#include "verifier_lsm.skel.h"
#include "verifier_jit_inline.skel.h"
#include "irq.skel.h"
+#include "verifier_ctx_ptr_param.skel.h"
#define MAX_ENTRIES 11
@@ -259,6 +260,7 @@ void test_verifier_lsm(void) { RUN(verifier_lsm); }
void test_irq(void) { RUN(irq); }
void test_verifier_mtu(void) { RUN(verifier_mtu); }
void test_verifier_jit_inline(void) { RUN(verifier_jit_inline); }
+void test_verifier_ctx_ptr_param(void) { RUN(verifier_ctx_ptr_param); }
static int init_test_val_map(struct bpf_object *obj, char *map_name)
{
diff --git a/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c b/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c
new file mode 100644
index 000000000000..b507dc850543
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c
@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Verifier tests for single- and multi-level pointer parameter handling
+ * Copyright (c) 2026 CrowdStrike, Inc.
+ */
+
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+#include "bpf_misc.h"
+
+SEC("fentry/bpf_fentry_test_ppvoid")
+__description("fentry/void**: void ** inferred as scalar")
+__success __retval(0)
+__log_level(2)
+__msg("R1=ctx() R2=scalar()")
+__naked void fentry_ppvoid_as_scalar(void)
+{
+ asm volatile (" \
+ r2 = *(u64 *)(r1 + 0); \
+ r0 = 0; \
+ exit; \
+ " ::: __clobber_all);
+}
+
+SEC("fentry/bpf_fentry_test_pppvoid")
+__description("fentry/void***: void *** inferred as scalar")
+__success __retval(0)
+__log_level(2)
+__msg("R1=ctx() R2=scalar()")
+__naked void fentry_pppvoid_as_scalar(void)
+{
+ asm volatile (" \
+ r2 = *(u64 *)(r1 + 0); \
+ r0 = 0; \
+ exit; \
+ " ::: __clobber_all);
+}
+
+SEC("fentry/bpf_fentry_test_ppfile")
+__description("fentry/struct file***: struct file *** inferred as scalar")
+__success __retval(0)
+__log_level(2)
+__msg("R1=ctx() R2=scalar()")
+__naked void fentry_ppfile_as_scalar(void)
+{
+ asm volatile (" \
+ r2 = *(u64 *)(r1 + 0); \
+ r0 = 0; \
+ exit; \
+ " ::: __clobber_all);
+}
+
+SEC("fexit/bpf_fexit_test_ret_ppfile")
+__description("fexit/return struct file**: returned struct file ** inferred as scalar")
+__success __retval(0)
+__log_level(2)
+__msg("R1=ctx() R2=scalar()")
+__naked void fexit_ppfile_as_scalar(void)
+{
+ asm volatile (" \
+ r2 = *(u64 *)(r1 + 0); \
+ r0 = 0; \
+ exit; \
+ " ::: __clobber_all);
+}
+
+char _license[] SEC("license") = "GPL";
--
2.34.1> diff --git a/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c b/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c
> new file mode 100644
> index 000000000000..b507dc850543
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c
[ ... ]
> +SEC("fentry/bpf_fentry_test_ppfile")
> +__description("fentry/struct file***: struct file *** inferred as scalar")
The description says "struct file ***" (triple pointer), but
bpf_fentry_test_ppfile() takes a struct file ** (double pointer):
net/bpf/test_run.c:
noinline void bpf_fentry_test_ppfile(struct file **ppf)
Should the description be
"fentry/struct file**: struct file ** inferred as scalar" instead?
> +__success __retval(0)
> +__log_level(2)
> +__msg("R1=ctx() R2=scalar()")
> +__naked void fentry_ppfile_as_scalar(void)
[ ... ]
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/23052798110
On Fri, Mar 13, 2026 at 6:55 AM <bot+bpf-ci@kernel.org> wrote:
>
> > diff --git a/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c b/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c
> > new file mode 100644
> > index 000000000000..b507dc850543
> > --- /dev/null
> > +++ b/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c
>
> [ ... ]
>
> > +SEC("fentry/bpf_fentry_test_ppfile")
> > +__description("fentry/struct file***: struct file *** inferred as scalar")
>
> The description says "struct file ***" (triple pointer), but
> bpf_fentry_test_ppfile() takes a struct file ** (double pointer):
>
> net/bpf/test_run.c:
> noinline void bpf_fentry_test_ppfile(struct file **ppf)
>
> Should the description be
> "fentry/struct file**: struct file ** inferred as scalar" instead?
Pls don't ignore bot reviews...
Do you agree or not?
On Sat, 14 Mar 2026 02:42:28 Alexei Starovoitov wrote:
> On Fri, Mar 13, 2026 at 6:55=E2=80=AFAM <bot+bpf-ci@kernel.org> wrote:
> >
> > > diff --git a/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c=
> b/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c
> > > new file mode 100644
> > > index 000000000000..b507dc850543
> > > --- /dev/null
> > > +++ b/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c
> >
> > [ ... ]
> >
> > > +SEC("fentry/bpf_fentry_test_ppfile")
> > > +__description("fentry/struct file***: struct file *** inferred as scal=
> ar")
> >
> > The description says "struct file ***" (triple pointer), but
> > bpf_fentry_test_ppfile() takes a struct file ** (double pointer):
> >
> > net/bpf/test_run.c:
> noinline void bpf_fentry_test_ppfile(struct file **ppf)
> >
> > Should the description be
> > "fentry/struct file**: struct file ** inferred as scalar" instead?
>
> Pls don't ignore bot reviews...
> Do you agree or not?
I'm not ignoring the bot - I'm in Australia and pushed this
patch late at night at 12:05 AM Saturday. The bot replied 50 minutes
later at 12:55 AM Saturday, and I was already not at my desktop.
I will make the necessary changes to the test description. The bot is
correct that it should have been "struct file **" - I mistakenly
carried over the triple pointer description when copy-pasting the
comments.
© 2016 - 2026 Red Hat, Inc.