From nobody Tue Apr 7 11:16:38 2026 Received: from mx0b-00206402.pphosted.com (mx0b-00206402.pphosted.com [148.163.152.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A96D1F151C; Fri, 13 Mar 2026 13:03:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.152.16 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773407010; cv=none; b=Ece1G2dBdQJP/lvLhQHSS8iXlHt990eNLHC1sBvxMqMVhQkut4X8pFTDbrouOJrqhmCFHFd4AgCLhGa830d19/nBesM98WzEj+O6CF0dV5y9vK57ADUKL4O1bxLl+ExYjKEMmhYBOOmg3rlD5sQ/7pZfeSI2w6iANeyndxqhfrg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773407010; c=relaxed/simple; bh=1zmQ8zQMj4MGfJJo7YfPo05bQHIBl28jvNdCXvqs8x0=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=NIWUoOcsTwqS64urkFMfsqAFbe5eQiIN1dP8dQE7utQj+XiUqaVNwXHwzGJBhoUQLHSaqqKuPB++PIhagxHg+BvqRXlwYTaziW5CVpTVs4zVG7aX4Y35M+08qbJD8EjYMXv1n9zGgnzfENqZvCCpoOUYKkieM7wbve9hYwhXxFQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=crowdstrike.com; spf=pass smtp.mailfrom=crowdstrike.com; dkim=pass (2048-bit key) header.d=crowdstrike.com header.i=@crowdstrike.com header.b=nrI2fmyZ; arc=none smtp.client-ip=148.163.152.16 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=crowdstrike.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=crowdstrike.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=crowdstrike.com header.i=@crowdstrike.com header.b="nrI2fmyZ" Received: from pps.filterd (m0354654.ppops.net [127.0.0.1]) by mx0b-00206402.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 62D97vHW895510; Fri, 13 Mar 2026 13:02:36 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=crowdstrike.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= default; bh=DuoEQ2pV/7yVh3IEgtmtI4tqjtw5lKwCATX4jI1eMJk=; b=nrI2 fmyZNR0IfbImdv+cwvXz6rmnG/R3T/CDcd23LcksIgiNQMbD69Y/gKYy1D0aPUMp /6jnUA0yA5C3Pc68vciYJXbgnYPNzRD6VezT7szniwUK1Au5+n4Y0hqRkVfphytx TT8lYe1Lh6yz5nnXpTwinhG7tJqalZ6cB2CpfBxJ06IcxuTgPNCNdazpAwwyBv7V X9u+PBH3QpcyatiIHZGfQjmNXPa+Zmh+mlBT48AUsWH7I5vgnujtZmQk0pBqCgcY PWWaODp8mkACL2pgcsmmUPT5+cXXt5Y+YCzVgQzEbIpZuuNkwOmwLFdQjyp2DT/f TRmqCcTFQe9LWX9qWQ== Received: from mail.crowdstrike.com (dragosx.crowdstrike.com [208.42.231.60] (may be forged)) by mx0b-00206402.pphosted.com (PPS) with ESMTPS id 4cuh51fjbx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 13 Mar 2026 13:02:36 +0000 (GMT) Received: from ML-CTVHTF21DX.crowdstrike.sys (10.100.11.122) by 04WPEXCH006.crowdstrike.sys (10.100.11.70) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.35; Fri, 13 Mar 2026 13:02:30 +0000 From: Slava Imameev To: , , CC: , , , , , , , , , , , , , , , , , , , , Slava Imameev Subject: [PATCH bpf-next v5 1/2] bpf: Support pointer param types via SCALAR_VALUE for trampolines Date: Sat, 14 Mar 2026 00:02:19 +1100 Message-ID: <20260313130220.18590-2-slava.imameev@crowdstrike.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260313130220.18590-1-slava.imameev@crowdstrike.com> References: <20260313130220.18590-1-slava.imameev@crowdstrike.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: 04WPEXCH014.crowdstrike.sys (10.100.11.87) To 04WPEXCH006.crowdstrike.sys (10.100.11.70) X-Disclaimer: USA X-Proofpoint-GUID: FPZz3Yijip3avmZxro_xXoPlBhoxwFY_ X-Authority-Analysis: v=2.4 cv=JtX8bc4C c=1 sm=1 tr=0 ts=69b40aec cx=c_pps a=1d8vc5iZWYKGYgMGCdbIRA==:117 a=1d8vc5iZWYKGYgMGCdbIRA==:17 a=EjBHVkixTFsA:10 a=Yq5XynenixoA:10 a=VkNPw1HP01LnGYTKEx00:22 a=T2KQ53IYiC3MXPrxx8bB:22 a=R_n4Uisa8axJ7jemP0ek:22 a=pl6vuDidAAAA:8 a=QHqYeUcJvB07a7jHZo8A:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzEzMDEwMyBTYWx0ZWRfX3KXvbyNRxodf 5rfohIJ6e8Xbz6uCFo92bIPbttFs5WWfirsJC1wG6+RXjXgAesPxWjYL6fu7i2m13XZbcP+eX5h 6iUQe9VKdjgCibwhqW36aomZ2KiYu60KCLqqR1Eigzumy7o/7a99MhL4KMvBJ13ESO4WKZbkOow P14amWlOkrOCXzWW5yY6gjIIqw1ihXlZbhdV3tTImZThQcrIVI41eU6MpJ/eP7s+eh6bTz0jKrS TKR3Hm+wroTB5TEWrNIwl+edmjFlXyO4Cxq6PvCaiBiZ7E2KBZmWoo36Ddp3XpvttpF4HJHDy24 CZZbbdfxKBGE/REKcHjKGNotPkQTG+POJt0M8Le2fcXdghCZ4rziD9dEgNL0GV8vfH2UPz0gPz/ imHPMWPaLwpkxkCs4/X0EDBCFSLHDu0mxVq46d34qXIlZh1h8B2nBYSX/4BAK9cks6PkBd/ibV4 ASNEmB+kiY49zABD9Gg== X-Proofpoint-ORIG-GUID: FPZz3Yijip3avmZxro_xXoPlBhoxwFY_ X-Proofpoint-Virus-Version: vendor=nai engine=6800 definitions=11728 signatures=596818 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 spamscore=0 phishscore=0 adultscore=0 malwarescore=0 priorityscore=1501 impostorscore=0 bulkscore=0 lowpriorityscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603050001 definitions=main-2603130103 Content-Type: text/plain; charset="utf-8" Add BPF verifier support for single- and multi-level pointer parameters and return values in BPF trampolines by treating these parameters as SCALAR_VALUE. This extends the existing support for int and void pointers that are already treated as SCALAR_VALUE. This provides consistent logic for single and multi-level pointers: if a type is treated as SCALAR for a single-level pointer, the same applies to multi-level pointers. The exception is pointer-to-struct, which is currently PTR_TO_BTF_ID for single-level but treated as scalar for multi-level pointers since the verifier lacks context to infer the size of target memory regions. Safety is ensured by existing BTF verification, which rejects invalid pointer types at the BTF verification stage. Signed-off-by: Slava Imameev --- kernel/bpf/btf.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 09fcbb125155..524bb2d6d964 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -6508,13 +6508,6 @@ struct btf *bpf_prog_get_target_btf(const struct bpf= _prog *prog) return prog->aux->attach_btf; } =20 -static bool is_void_or_int_ptr(struct btf *btf, const struct btf_type *t) -{ - /* skip modifiers */ - t =3D btf_type_skip_modifiers(btf, t->type, NULL); - return btf_type_is_void(t) || btf_type_is_int(t); -} - u32 btf_ctx_arg_idx(struct btf *btf, const struct btf_type *func_proto, int off) { @@ -6903,10 +6896,14 @@ bool btf_ctx_access(int off, int size, enum bpf_acc= ess_type type, } =20 /* - * If it's a pointer to void, it's the same as scalar from the verifier - * safety POV. Either way, no futher pointer walking is allowed. + * If it's a single or multilevel pointer, except a pointer + * to a structure, it's the same as scalar from the verifier + * safety POV. Multilevel pointers to structures are treated as + * scalars. The verifier lacks the context to infer the size of + * their target memory regions. Either way, no further pointer + * walking is allowed. */ - if (is_void_or_int_ptr(btf, t)) + if (!btf_type_is_struct_ptr(btf, t)) return true; =20 /* this is a pointer to another type */ --=20 2.34.1 From nobody Tue Apr 7 11:16:38 2026 Received: from mx0b-00206402.pphosted.com (mx0b-00206402.pphosted.com [148.163.152.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0CF3127456; Fri, 13 Mar 2026 13:03:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.152.16 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773407001; cv=none; b=qJNDBrjd48ubhNZcq3K6cuzkv6aS0svplqcKdMxhRcRHemDEMt0FfWgBbWiV1vrjvbv/H0cs9NW0hko4etnQREUEeKs18kispXDEAogRIxWkQ/ekdqQYGXlZFqKVZmbHZCxJHiT0PAivP5TSvhd4Rs5zHWkGpiUhaCDM0S/dI3E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773407001; c=relaxed/simple; bh=5mNoHIACtt9SZgMP0Y+R8drx7nGYHYBDolSvg789j/I=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=I37GHqCGXjUz3/UuMyYEReVttcS+cmmx0SzpSbVasyswOWyBPLOylqBLNq+ECPaPn7ACd4JKPuzXU8kxsQ3KanE4JnMxlTp4THO3OG4jqnO6MiZ+2TQoJLDWfrSxP6lPYoPbb6+bYAxzD4JY4npslKq9P99TpWt7LOeluwWu1bI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=crowdstrike.com; spf=pass smtp.mailfrom=crowdstrike.com; dkim=pass (2048-bit key) header.d=crowdstrike.com header.i=@crowdstrike.com header.b=KakmyC2t; arc=none smtp.client-ip=148.163.152.16 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=crowdstrike.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=crowdstrike.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=crowdstrike.com header.i=@crowdstrike.com header.b="KakmyC2t" Received: from pps.filterd (m0354653.ppops.net [127.0.0.1]) by mx0b-00206402.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 62D92K5O1066675; Fri, 13 Mar 2026 13:02:42 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=crowdstrike.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= default; bh=MR9Y7/vrxBVXCj8cRh5AdHsWfo3OwqgvnazIkEnjRPg=; b=Kakm yC2t2grpA9wMPTmgl8NL+Gn9DMYc4Fad54Gia79BXTwMybx9qnio5FuNjWP64M7v Qt6fB5yYAdxGOTgzA/h6FdUV0xSrXmPDxUQFJpC0G6+OBAwD+FtLsINZ1/torboy gcmtnCEZ1SAaBK/q0Z+cq7x3ax8iLP4Ab54Bww7MByCNogqjqd10Vwg2I6Lfp6TT Y2CGMuZ82TBr0n4km9Z7mLO+hmKJ+Kn5UIRPSD6Q0uKwiyiSnvECZNYuBc4Pv6Ot /LiRkQuDjmaQOHptI1VEbai17UtjRyho2X+IW14mLSgJy5s5ICnRrx2+e4/+CnxX 85Hr6pKRtTvhNPFVJg== Received: from mail.crowdstrike.com (dragosx.crowdstrike.com [208.42.231.60] (may be forged)) by mx0b-00206402.pphosted.com (PPS) with ESMTPS id 4cuh5y7jdw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 13 Mar 2026 13:02:41 +0000 (GMT) Received: from ML-CTVHTF21DX.crowdstrike.sys (10.100.11.122) by 04WPEXCH006.crowdstrike.sys (10.100.11.70) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.35; Fri, 13 Mar 2026 13:02:35 +0000 From: Slava Imameev To: , , CC: , , , , , , , , , , , , , , , , , , , , Slava Imameev Subject: [PATCH bpf-next v5 2/2] selftests/bpf: Add trampolines single and multi-level pointer params test coverage Date: Sat, 14 Mar 2026 00:02:20 +1100 Message-ID: <20260313130220.18590-3-slava.imameev@crowdstrike.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260313130220.18590-1-slava.imameev@crowdstrike.com> References: <20260313130220.18590-1-slava.imameev@crowdstrike.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: 04WPEXCH014.crowdstrike.sys (10.100.11.87) To 04WPEXCH006.crowdstrike.sys (10.100.11.70) X-Disclaimer: USA X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzEzMDEwMyBTYWx0ZWRfX58nb4hHpLRYZ tP3s2Bl4m1zW0Ohbf6mNL4r+5np5oYt2/y6TIi1N09uE/BqTD1YOIV0LKLohOo6Utqvf8B4je61 NwKXzeY3JLQOtoFci22QW4YJCfUiskx/J/GiEeuE/O2rDZlSUPyR6RpCAoJVRHxKw2u6G3ZIHaZ Sc70Z1PAfdfDV7xBA8MTF2CyIlVF5epDv7uZ1YlgcZ+rCZqfFXidok49UeMpsZLhxRn3h7/rCvg YjmZfjeE6rFW0NLneF/hFGd6zYKeGZSzENkEPYg5iXKAonn5LpFwWHtwHxOK+iDAB+6MYARFNga hZVeDiZBK9QxpP5GqrvXTlla6PSEEuKMUJVIYlKxbYZJa6QXFLwkGYiVKPqkFKjtqMvcX9KgoOx ohRik9pbD0jNP1ezEoRA/l0aLy2+g10Ie1flilV3Lu5tm1Dbx0VsFwOBww4i4N1QhI81/ZqZdB7 ShLy9jtCuiQX8yLq4wQ== X-Proofpoint-ORIG-GUID: bv9DVZeJD2XCzeXFu_iwq4DoWGE8bglk X-Authority-Analysis: v=2.4 cv=Mt1fKmae c=1 sm=1 tr=0 ts=69b40af1 cx=c_pps a=1d8vc5iZWYKGYgMGCdbIRA==:117 a=1d8vc5iZWYKGYgMGCdbIRA==:17 a=EjBHVkixTFsA:10 a=Yq5XynenixoA:10 a=VkNPw1HP01LnGYTKEx00:22 a=T2KQ53IYiC3MXPrxx8bB:22 a=GCXdLZfFv8EKBZhKOxZ5:22 a=pl6vuDidAAAA:8 a=Vh-PTBDqdCVuQZtVsP0A:9 X-Proofpoint-GUID: bv9DVZeJD2XCzeXFu_iwq4DoWGE8bglk X-Proofpoint-Virus-Version: vendor=nai engine=6800 definitions=11728 signatures=596818 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 spamscore=0 impostorscore=0 lowpriorityscore=0 bulkscore=0 suspectscore=0 clxscore=1015 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603050001 definitions=main-2603130103 Content-Type: text/plain; charset="utf-8" Add single and multi-level pointer parameters and return value test coverage for BPF trampolines. Includes verifier tests for single and multi-level pointers. The tests check verifier logs for pointers inferred as scalar() type. Signed-off-by: Slava Imameev --- net/bpf/test_run.c | 17 +++++ .../selftests/bpf/prog_tests/verifier.c | 2 + .../bpf/progs/verifier_ctx_ptr_param.c | 68 +++++++++++++++++++ 3 files changed, 87 insertions(+) create mode 100644 tools/testing/selftests/bpf/progs/verifier_ctx_ptr_para= m.c diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index 56bc8dc1e281..14c4814a7dab 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -567,6 +567,23 @@ noinline void bpf_fentry_test_sinfo(struct skb_shared_= info *sinfo) { } =20 +noinline void bpf_fentry_test_ppvoid(void **pp) +{ +} + +noinline void bpf_fentry_test_pppvoid(void ***ppp) +{ +} + +noinline void bpf_fentry_test_ppfile(struct file **ppf) +{ +} + +noinline struct file **bpf_fexit_test_ret_ppfile(void) +{ + return (struct file **)NULL; +} + __bpf_kfunc int bpf_modify_return_test(int a, int *b) { *b +=3D 1; diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/test= ing/selftests/bpf/prog_tests/verifier.c index 8cdfd74c95d7..bcf01cb4cfe4 100644 --- a/tools/testing/selftests/bpf/prog_tests/verifier.c +++ b/tools/testing/selftests/bpf/prog_tests/verifier.c @@ -115,6 +115,7 @@ #include "verifier_lsm.skel.h" #include "verifier_jit_inline.skel.h" #include "irq.skel.h" +#include "verifier_ctx_ptr_param.skel.h" =20 #define MAX_ENTRIES 11 =20 @@ -259,6 +260,7 @@ void test_verifier_lsm(void) { RUN(ver= ifier_lsm); } void test_irq(void) { RUN(irq); } void test_verifier_mtu(void) { RUN(verifier_mtu); } void test_verifier_jit_inline(void) { RUN(verifier_jit_inlin= e); } +void test_verifier_ctx_ptr_param(void) { RUN(verifier_ctx_ptr_param)= ; } =20 static int init_test_val_map(struct bpf_object *obj, char *map_name) { diff --git a/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c b/t= ools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c new file mode 100644 index 000000000000..b507dc850543 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/verifier_ctx_ptr_param.c @@ -0,0 +1,68 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Verifier tests for single- and multi-level pointer parameter handling + * Copyright (c) 2026 CrowdStrike, Inc. + */ + +#include +#include +#include +#include "bpf_misc.h" + +SEC("fentry/bpf_fentry_test_ppvoid") +__description("fentry/void**: void ** inferred as scalar") +__success __retval(0) +__log_level(2) +__msg("R1=3Dctx() R2=3Dscalar()") +__naked void fentry_ppvoid_as_scalar(void) +{ + asm volatile (" \ + r2 =3D *(u64 *)(r1 + 0); \ + r0 =3D 0; \ + exit; \ + " ::: __clobber_all); +} + +SEC("fentry/bpf_fentry_test_pppvoid") +__description("fentry/void***: void *** inferred as scalar") +__success __retval(0) +__log_level(2) +__msg("R1=3Dctx() R2=3Dscalar()") +__naked void fentry_pppvoid_as_scalar(void) +{ + asm volatile (" \ + r2 =3D *(u64 *)(r1 + 0); \ + r0 =3D 0; \ + exit; \ + " ::: __clobber_all); +} + +SEC("fentry/bpf_fentry_test_ppfile") +__description("fentry/struct file***: struct file *** inferred as scalar") +__success __retval(0) +__log_level(2) +__msg("R1=3Dctx() R2=3Dscalar()") +__naked void fentry_ppfile_as_scalar(void) +{ + asm volatile (" \ + r2 =3D *(u64 *)(r1 + 0); \ + r0 =3D 0; \ + exit; \ + " ::: __clobber_all); +} + +SEC("fexit/bpf_fexit_test_ret_ppfile") +__description("fexit/return struct file**: returned struct file ** inferre= d as scalar") +__success __retval(0) +__log_level(2) +__msg("R1=3Dctx() R2=3Dscalar()") +__naked void fexit_ppfile_as_scalar(void) +{ + asm volatile (" \ + r2 =3D *(u64 *)(r1 + 0); \ + r0 =3D 0; \ + exit; \ + " ::: __clobber_all); +} + +char _license[] SEC("license") =3D "GPL"; --=20 2.34.1