From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f41.google.com (mail-yx1-f41.google.com [74.125.224.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF8C013A3F7 for ; Tue, 2 Dec 2025 14:19:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764685199; cv=none; b=L7cBNMjjfPQy5rebY+/E/ZzEi6QWbw3jVY5cOclTKMT3Tm6XIIcdgCoI5OJaCECl43DGLjDOFC5k423TgBt6Ci8DXMn9ENjaoOkHInVGzvjwd5C7XMssm+PRgHVzcS0+4xNXOAOGsV0sxzguhBU65zVBI3ET28W6vd2TOS4xsYw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764685199; c=relaxed/simple; bh=TvhO8/wWsryTXGAN0owlp5rKTKABTyepxFYULy3W2mU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=LSkuFN5rxsvy3NH5cc036DF6CnsedYEr6r1JEcWJLHk8WvGl7InmXm9lFnapW6MwIW3HiO4vtmCvhMAXPrvrkCy6xglLz5rFlaggFwbOdZGgyayGkHItRPeFNaFQ4XFI04b3YqBe3071Jry6qvQzLdV29c3vFNpo0gYrfehTAiI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IVQNfwkS; arc=none smtp.client-ip=74.125.224.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IVQNfwkS" Received: by mail-yx1-f41.google.com with SMTP id 956f58d0204a3-64308342458so4934692d50.0 for ; Tue, 02 Dec 2025 06:19:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764685197; x=1765289997; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=FZYiG845U9rknD0u3O9bp1/PvtZ8OwPH+UQAfLpgMIw=; b=IVQNfwkSQTVE/cj/HGW3SAvX2ZCamyuGLhFtiFuage7RozWddsEOXUfEDDgQzzJCsC /IYhg8ziRD2jvu+wcokxqSUaP+ROWGJL6MFEQpabuZdXR6TgHYZp4D9idQYqw2qukBfv cYmv0E54pihH6GK6dwn4NXaisBOPkVJpvGUmvX9rKMV+tRo7HWejyjtZHUQewniL/k+J k4KGmuYyWq5z+Y0D7gaCxQ5ngx8QY5KiwNtBjRakhtvj5XpmCvVaL67gqkYJftzLGN/F 8Q/Tgx9zK4YVyR5wEryhItze4uAGhmlrhSoIoX8XpmlSXpLoVldNAM1tmEYwNMgApsSF uSGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764685197; x=1765289997; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=FZYiG845U9rknD0u3O9bp1/PvtZ8OwPH+UQAfLpgMIw=; b=ZGyCS5+kTfFP/aV9SN5UiEA1po9bHOfxItjEusNXLSvU9gMJe7HGaguhXwkW6dPwNQ cno4uQgGMrtI58wv3fE/3BSXwiYyBeT+xi/D7vcs5FJeDBWQJDThL4VHuS3Gfgw7z08o UUjgf5ik1MtmBBTqEtEF0dKyrh1dvOrqYp12pDYShUIS7vkaR/LvVvHdALDQ7gXoC3mo slUKVZRhw8d4an4Yf5CCgjb9L7GWXw7MVIJmIfSGw0IOHhAv1wouzFn9I6rWqLjIaVpo Kg1Y0vO9CYKZL7JB5lXv9mVo/095hFMGR6304Tt8o4791DFigGm4pQpMp+0MdGMbo2kJ x9TA== X-Forwarded-Encrypted: i=1; AJvYcCUDTbX8sYvJhb+9W2gjUw1TDRSi2P+H0uMFZJyblqHLp4Wy5/AisNKBXpm/Ixwp90r4mm7AZa63A3mLkDw=@vger.kernel.org X-Gm-Message-State: AOJu0YyCr/GQ4XqNvYNv3E7BmgoBTqESIwEDRHNapAAfxMGasH+EIaCZ UuoyQIWG1eRBtCiyZrsKi/rsMKEFs0GSIgnMST+DpRWWtHOY8SXm2ErL X-Gm-Gg: ASbGncudX+ADzC0hqINhR7025+Ei6xktzG5dXPEajIBiv63AtJDXx3jBIInFOMsiyTi lW2E5QCn1GJKYXdYNMevZ5MIl1SLnwGx9koretvOrzfaYbfxzjzWHBiQmNswerXftc61vkOslyD bb75k1Cz3Vj8gCXnJoWHVWnAFvNMzqemERn1BEEQd9V3IRppeRjCILKm8+6ysLWAfzTkIhHPr10 9Pdy9rwLpTW6V+juuUWDJ66yg7NXO2agWcZpRpKuRwaD9dMemFNbCoHLmRkQwoN66Z91IU8x8Nt Oymib+kHq8JKtGJz4uKpJql/a1jcYvRWxe4nqHVyyZebXIWBV58yyjcNrWAMOxNkc7ehr+egA8B U2Hp9U//+QzuzdJdu5yMcWIV/vZIUM7fIUJhrd0Gp9BNdowlE1nEdJKqGpOmMGhB/KCBh7nuHK5 uPHhrEuSxaGNYl044y/2ZFNMGl0eHhRCo/03c3qY1I2PXzd1dZ8ga7VtkA08BbrQ== X-Google-Smtp-Source: AGHT+IEBiHZjjwJYZm4wcRsjMQxrAiRlrUNXkeZHkzrztMI4TVsP7sWW8UWzi8YGWUgGsSgqi5H7mg== X-Received: by 2002:a05:690e:12c9:b0:643:1a78:4492 with SMTP id 956f58d0204a3-6431a78497dmr23565216d50.81.1764685196722; Tue, 02 Dec 2025 06:19:56 -0800 (PST) Received: from localhost.localdomain (45.62.117.175.16clouds.com. [45.62.117.175]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-6433c497768sm6257715d50.25.2025.12.02.06.19.51 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 02 Dec 2025 06:19:56 -0800 (PST) From: Shuran Liu To: song@kernel.org, mattbobrowski@google.com, bpf@vger.kernel.org Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, martin.lau@linux.dev, eddyz87@gmail.com, yonghong.song@linux.dev, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, rostedt@goodmis.org, mhiramat@kernel.org, mathieu.desnoyers@efficios.com, linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, dxu@dxuuu.xyz, linux-kselftest@vger.kernel.org, shuah@kernel.org, electronlsr@gmail.com Subject: [PATCH bpf v3 0/2] bpf: fix bpf_d_path() helper prototype Date: Tue, 2 Dec 2025 22:19:42 +0800 Message-ID: <20251202141944.2209-1-electronlsr@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Hi, This series fixes a verifier issue with bpf_d_path() and adds a regression test to cover its use from an LSM program. Patch 1 updates the bpf_d_path() helper prototype so that the second argument is marked as MEM_WRITE. This makes it explicit to the verifier that the helper writes into the provided buffer. Patch 2 extends the existing d_path selftest to also cover the LSM bprm_check_security hook. The LSM program calls bpf_d_path() on the binary being executed and performs a simple prefix comparison on the resulting pathname. To avoid nondeterminism, the program filters based on an expected PID that is populated from userspace before the test binary is executed, and the parent and child processes are synchronized through a pipe so that the PID is set before exec. The test now uses bpf_for() to express the small fixed-iteration loop in a verifier-friendly way, and it removes the temporary /tmp/bpf_d_path_test binary in the cleanup path. Changelog ========= v3: - Switch the pathname prefix loop to use bpf_for() instead of #pragma unroll, as suggested by Matt. - Remove /tmp/bpf_d_path_test in the test cleanup path. - Add the missing Reviewed-by tags. v2: - Merge the new test into the existing d_path selftest rather than creating new files. - Add PID filtering in the LSM program to avoid nondeterministic failures due to unrelated processes triggering bprm_check_security. - Synchronize child execution using a pipe to ensure deterministic updates to the PID. Thanks for your time and reviews. Shuran Liu (2): bpf: mark bpf_d_path() buffer as writeable selftests/bpf: fix and consolidate d_path LSM regression test kernel/trace/bpf_trace.c | 2 +- .../testing/selftests/bpf/prog_tests/d_path.c | 65 +++++++++++++++++++ .../testing/selftests/bpf/progs/test_d_path.c | 33 ++++++++++ 3 files changed, 99 insertions(+), 1 deletion(-) -- 2.52.0