[PATCH bpf-next v4 0/6] bpf: Add syscall common attrs support for xdp link_create

[PATCH bpf-next v4 0/6] bpf: Add syscall common attrs support for xdp link_create

[Leon Hwang]

I'm planning to add syscall common attrs support for LINK_CREATE cmd.

This is the first series for the plan, that adds syscall common attrs
support for xdp LINK_CREATE.

Thereafter, retire the tracepoint bpf_xdp_link_attach_failed, because
the underlying driver's error can be back-propagated to user space via
the syscall common attrs.

Changes:
v3 -> v4:
* Pass errmsg pointer to bpf_xdp_link_attach(). (Jakub)
* Place log_opts at the slot of iter_info in libbpf. (Andrii)
* v3: https://lore.kernel.org/bpf/20261020152804.39863-1-leon.hwang@linux.dev/

v2 -> v3:
* Drop bpf_log_attr_report_size() helper. (Alexei)
* Drop 2nd write for log_true_size and the put_prog label. (Alexei)
* v2: https://lore.kernel.org/bpf/20261019153628.15912-1-leon.hwang@linux.dev/

v1 -> v2:
* Add log for invalid prog type in link_create().
* Reject log_opts for fallback bpf_raw_tracepoint_open() in libbpf.
* Report log_true_size as 0 before creating concrete link, and report
  the actual log_true_size when fail to create the concrete link.
  (Sashiko)
* Add stub bpf_log() when CONFIG_BPF_SYSCALL is not set. (bots)
* Check 'extack._msg' before adding 'extack._msg' to log buffer.
  (Sashiko, bot+bpf-ci)
* Change __bpf_sys_fd to __sys_bpf_fd in the subject and body of
  patch 4. (bot+bpf-ci)
* Move OPTS_VALID(opts, bpf_link_create_opts) to __sys_bpf_fd(). (Sashiko)
* Move bpf_link_create_log to the LIBBPF_1.9.0 section. (Sashiko)
* Update patch msg with a concrete case in patch 5. (bot+bpf-ci)
* Factor out helpers to simplify the tests code. (bot+bpf-ci)
* v1: https://lore.kernel.org/bpf/20261017142649.51047-1-leon.hwang@linux.dev/

Leon Hwang (6):
  bpf: Add syscall common attrs support for link_create
  bpf: Add syscall common attrs support for xdp link_create
  bpf: Retire tracepoint bpf_xdp_link_attach_failed
  libbpf: Factor out __sys_bpf_fd helper
  libbpf: Add log_opts support for bpf_link_create
  selftests/bpf: Add tests to verify link_create logs

 include/linux/netdevice.h                     |   3 +-
 include/trace/events/xdp.h                    |  17 ---
 kernel/bpf/syscall.c                          |  43 ++++++--
 net/core/dev.c                                |   7 +-
 tools/lib/bpf/bpf.c                           |  61 +++++++----
 tools/lib/bpf/bpf.h                           |   5 +-
 .../selftests/bpf/prog_tests/xdp_attach.c     |  65 -----------
 .../selftests/bpf/prog_tests/xdp_link.c       | 102 ++++++++++++++++++
 .../bpf/progs/test_xdp_attach_fail.c          |  54 ----------
 9 files changed, 190 insertions(+), 167 deletions(-)
 delete mode 100644 tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c

-- 
2.55.0

[PATCH bpf-next v4 1/6] bpf: Add syscall common attrs support for link_create

[Leon Hwang]

Similar to the syscall common attrs support for map_create [1], add the
syscall common attrs support for link_create.

Create and finalize the internal verifier log instance.

Then, report the error messages for invalid prog fd, invalid attach type,
and invalid prog type.

Links:
[1] https://lore.kernel.org/bpf/20260514004634.3DA09C19425@smtp.kernel.org/

Link: https://lore.kernel.org/bpf/20260514004634.3DA09C19425@smtp.kernel.org/
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 kernel/bpf/syscall.c | 35 ++++++++++++++++++++++++++++-------
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 90bc7230afa8..db870e795d04 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -5862,8 +5862,11 @@ static int bpf_map_do_batch(const union bpf_attr *attr,
 }
 
 #define BPF_LINK_CREATE_LAST_FIELD link_create.uprobe_multi.path_fd
-static int link_create(union bpf_attr *attr, bpfptr_t uattr)
+static int link_create(union bpf_attr *attr, bpfptr_t uattr, struct bpf_common_attr *attr_common,
+		       bpfptr_t uattr_common, u32 size_common)
 {
+	struct bpf_verifier_log *log;
+	struct bpf_log_attr attr_log;
 	struct bpf_prog *prog;
 	int ret;
 
@@ -5873,14 +5876,24 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
 	if (attr->link_create.attach_type == BPF_STRUCT_OPS)
 		return bpf_struct_ops_link_create(attr);
 
+	log = bpf_log_attr_create_vlog(&attr_log, attr_common, uattr_common, size_common);
+	if (IS_ERR(log))
+		return PTR_ERR(log);
+
 	prog = bpf_prog_get(attr->link_create.prog_fd);
-	if (IS_ERR(prog))
-		return PTR_ERR(prog);
+	if (IS_ERR(prog)) {
+		bpf_log(log, "Invalid prog_fd.\n");
+		ret = PTR_ERR(prog);
+		prog = NULL;
+		goto out;
+	}
 
 	ret = bpf_prog_attach_check_attach_type(prog,
 						attr->link_create.attach_type);
-	if (ret)
+	if (ret) {
+		bpf_log(log, "Invalid attach_type.\n");
 		goto out;
+	}
 
 	switch (prog->type) {
 	case BPF_PROG_TYPE_CGROUP_SKB:
@@ -5959,12 +5972,20 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
 			ret = bpf_uprobe_multi_link_attach(attr, prog);
 		break;
 	default:
+		bpf_log(log, "Invalid prog type.\n");
 		ret = -EINVAL;
 	}
 
 out:
-	if (ret < 0)
-		bpf_prog_put(prog);
+	if (ret < 0) {
+		int err;
+
+		err = bpf_log_attr_finalize(&attr_log, log);
+		ret = err ? err : ret;
+		if (prog)
+			bpf_prog_put(prog);
+	}
+	kfree(log);
 	return ret;
 }
 
@@ -6536,7 +6557,7 @@ static int __sys_bpf(enum bpf_cmd cmd, bpfptr_t uattr, unsigned int size,
 		err = bpf_map_do_batch(&attr, uattr.user, BPF_MAP_DELETE_BATCH);
 		break;
 	case BPF_LINK_CREATE:
-		err = link_create(&attr, uattr);
+		err = link_create(&attr, uattr, &attr_common, uattr_common, size_common);
 		break;
 	case BPF_LINK_UPDATE:
 		err = link_update(&attr);
-- 
2.55.0

[PATCH bpf-next v4 2/6] bpf: Add syscall common attrs support for xdp link_create

[Leon Hwang]

With the syscall common attrs support for link_create, add syscall common
attrs support for xdp link_create in order to report the invalid target
ifindex error and the underlying driver's error.

Instead of passing bpf log or extack to bpf_xdp_link_attach(), pass an
errmsg pointer to receive the kstrdup() error msg, because
1) passing bpf log will introduce bpf_verifier.h dependency for
   net/core/dev.c, which is not acceptable for maintainability.
2) passing extack will access underlying driver string out of dev_put()
   guard, which will crash kernel when the device is unloaded
   concurrently.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 include/linux/netdevice.h | 3 ++-
 kernel/bpf/syscall.c      | 8 +++++++-
 net/core/dev.c            | 6 +++++-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index c0ae442c4344..e07b740604c7 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -4440,7 +4440,8 @@ struct sk_buff *validate_xmit_skb_list(struct sk_buff *skb, struct net_device *d
 struct sk_buff *dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
 				    struct netdev_queue *txq, int *ret);
 
-int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog);
+int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog,
+			char **errmsg);
 u8 dev_xdp_prog_count(struct net_device *dev);
 int netif_xdp_propagate(struct net_device *dev, struct netdev_bpf *bpf);
 int dev_xdp_propagate(struct net_device *dev, struct netdev_bpf *bpf);
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index db870e795d04..675bff4d7aab 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -5868,6 +5868,7 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr, struct bpf_common_a
 	struct bpf_verifier_log *log;
 	struct bpf_log_attr attr_log;
 	struct bpf_prog *prog;
+	char *errmsg = NULL;
 	int ret;
 
 	if (CHECK_ATTR(BPF_LINK_CREATE))
@@ -5944,7 +5945,7 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr, struct bpf_common_a
 		break;
 #ifdef CONFIG_NET
 	case BPF_PROG_TYPE_XDP:
-		ret = bpf_xdp_link_attach(attr, prog);
+		ret = bpf_xdp_link_attach(attr, prog, &errmsg);
 		break;
 	case BPF_PROG_TYPE_SCHED_CLS:
 		if (attr->link_create.attach_type == BPF_TCX_INGRESS ||
@@ -5980,6 +5981,11 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr, struct bpf_common_a
 	if (ret < 0) {
 		int err;
 
+		if (errmsg) {
+			bpf_log(log, "%s\n", errmsg);
+			kfree(errmsg);
+		}
+
 		err = bpf_log_attr_finalize(&attr_log, log);
 		ret = err ? err : ret;
 		if (prog)
diff --git a/net/core/dev.c b/net/core/dev.c
index 1a09e7869118..da71c0d2120c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -10882,7 +10882,8 @@ static const struct bpf_link_ops bpf_xdp_link_lops = {
 	.update_prog = bpf_xdp_link_update,
 };
 
-int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
+int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog,
+			char **errmsg)
 {
 	struct net *net = current->nsproxy->net_ns;
 	struct bpf_link_primer link_primer;
@@ -10895,6 +10896,7 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
 	dev = dev_get_by_index(net, attr->link_create.target_ifindex);
 	if (!dev) {
 		rtnl_unlock();
+		*errmsg = kstrdup("Invalid target_ifindex.", GFP_KERNEL);
 		return -EINVAL;
 	}
 
@@ -10923,6 +10925,8 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
 	if (err) {
 		link->dev = NULL;
 		bpf_link_cleanup(&link_primer);
+		if (extack._msg)
+			*errmsg = kstrdup(extack._msg, GFP_KERNEL);
 		trace_bpf_xdp_link_attach_failed(extack._msg);
 		goto out_put_dev;
 	}
-- 
2.55.0

[PATCH bpf-next v4 3/6] bpf: Retire tracepoint bpf_xdp_link_attach_failed

[Leon Hwang]

In the previous patch, it has a proper way to back-propagate the
underlying driver error message to user space via the BPF syscall common
attributes.

The tracepoint bpf_xdp_link_attach_failed seems redundant to report the
error message. And, the tracepoint doesn't report the ifindex alongside
the error message [1].

So, retire the tracepoint bpf_xdp_link_attach_failed and its selftest.

According to the tracepoint change discussion [2], please revert this
patch if users complain about the disappeared tracepoint
bpf_xdp_link_attach_failed in the future.

Links:
[1] https://lore.kernel.org/bpf/CAFk-A4mE9Jweo2hfX7y_85xbPyt0FqpMT1EvqX1OcYZ=LTLgRA@mail.gmail.com/
[2] https://lore.kernel.org/linux-mm/CY8PR11MB7134346A3E4BB28ECA28D6E989132@CY8PR11MB7134.namprd11.prod.outlook.com/

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 include/trace/events/xdp.h                    | 17 -----
 net/core/dev.c                                |  1 -
 .../selftests/bpf/prog_tests/xdp_attach.c     | 65 -------------------
 .../bpf/progs/test_xdp_attach_fail.c          | 54 ---------------
 4 files changed, 137 deletions(-)
 delete mode 100644 tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c

diff --git a/include/trace/events/xdp.h b/include/trace/events/xdp.h
index 18c0ac514fcb..f1d4d0702884 100644
--- a/include/trace/events/xdp.h
+++ b/include/trace/events/xdp.h
@@ -362,23 +362,6 @@ TRACE_EVENT(mem_connect,
 	)
 );
 
-TRACE_EVENT(bpf_xdp_link_attach_failed,
-
-	TP_PROTO(const char *msg),
-
-	TP_ARGS(msg),
-
-	TP_STRUCT__entry(
-		__string(msg, msg)
-	),
-
-	TP_fast_assign(
-		__assign_str(msg);
-	),
-
-	TP_printk("errmsg=%s", __get_str(msg))
-);
-
 #endif /* _TRACE_XDP_H */
 
 #include <trace/define_trace.h>
diff --git a/net/core/dev.c b/net/core/dev.c
index da71c0d2120c..5c42aeec327e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -10927,7 +10927,6 @@ int bpf_xdp_link_attach(const union bpf_attr *attr, struct bpf_prog *prog,
 		bpf_link_cleanup(&link_primer);
 		if (extack._msg)
 			*errmsg = kstrdup(extack._msg, GFP_KERNEL);
-		trace_bpf_xdp_link_attach_failed(extack._msg);
 		goto out_put_dev;
 	}
 
diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_attach.c b/tools/testing/selftests/bpf/prog_tests/xdp_attach.c
index e6bcb6051402..fa3cac5488f5 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_attach.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_attach.c
@@ -1,6 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <test_progs.h>
-#include "test_xdp_attach_fail.skel.h"
 
 #define IFINDEX_LO 1
 #define XDP_FLAGS_REPLACE		(1U << 4)
@@ -86,74 +85,10 @@ static void test_xdp_attach(const char *file)
 	bpf_object__close(obj1);
 }
 
-#define ERRMSG_LEN 64
-
-struct xdp_errmsg {
-	char msg[ERRMSG_LEN];
-};
-
-static void on_xdp_errmsg(void *ctx, int cpu, void *data, __u32 size)
-{
-	struct xdp_errmsg *ctx_errmg = ctx, *tp_errmsg = data;
-
-	memcpy(&ctx_errmg->msg, &tp_errmsg->msg, ERRMSG_LEN);
-}
-
-static const char tgt_errmsg[] = "Invalid XDP flags for BPF link attachment";
-
-static void test_xdp_attach_fail(const char *file)
-{
-	struct test_xdp_attach_fail *skel = NULL;
-	struct xdp_errmsg errmsg = {};
-	struct perf_buffer *pb = NULL;
-	struct bpf_object *obj = NULL;
-	int err, fd_xdp;
-
-	LIBBPF_OPTS(bpf_link_create_opts, opts);
-
-	skel = test_xdp_attach_fail__open_and_load();
-	if (!ASSERT_OK_PTR(skel, "test_xdp_attach_fail__open_and_load"))
-		goto out_close;
-
-	err = test_xdp_attach_fail__attach(skel);
-	if (!ASSERT_EQ(err, 0, "test_xdp_attach_fail__attach"))
-		goto out_close;
-
-	/* set up perf buffer */
-	pb = perf_buffer__new(bpf_map__fd(skel->maps.xdp_errmsg_pb), 1,
-			      on_xdp_errmsg, NULL, &errmsg, NULL);
-	if (!ASSERT_OK_PTR(pb, "perf_buffer__new"))
-		goto out_close;
-
-	err = bpf_prog_test_load(file, BPF_PROG_TYPE_XDP, &obj, &fd_xdp);
-	if (!ASSERT_EQ(err, 0, "bpf_prog_test_load"))
-		goto out_close;
-
-	opts.flags = 0xFF; // invalid flags to fail to attach XDP prog
-	err = bpf_link_create(fd_xdp, IFINDEX_LO, BPF_XDP, &opts);
-	if (!ASSERT_EQ(err, -EINVAL, "bpf_link_create"))
-		goto out_close;
-
-	/* read perf buffer */
-	err = perf_buffer__poll(pb, 100);
-	if (!ASSERT_GT(err, -1, "perf_buffer__poll"))
-		goto out_close;
-
-	ASSERT_STRNEQ((const char *) errmsg.msg, tgt_errmsg,
-		      42 /* strlen(tgt_errmsg) */, "check error message");
-
-out_close:
-	perf_buffer__free(pb);
-	bpf_object__close(obj);
-	test_xdp_attach_fail__destroy(skel);
-}
-
 void serial_test_xdp_attach(void)
 {
 	if (test__start_subtest("xdp_attach"))
 		test_xdp_attach("./test_xdp.bpf.o");
 	if (test__start_subtest("xdp_attach_dynptr"))
 		test_xdp_attach("./test_xdp_dynptr.bpf.o");
-	if (test__start_subtest("xdp_attach_failed"))
-		test_xdp_attach_fail("./xdp_dummy.bpf.o");
 }
diff --git a/tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c b/tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c
deleted file mode 100644
index 2ff1b596e87e..000000000000
--- a/tools/testing/selftests/bpf/progs/test_xdp_attach_fail.c
+++ /dev/null
@@ -1,54 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/* Copyright Leon Hwang */
-
-#include <linux/bpf.h>
-#include <bpf/bpf_helpers.h>
-
-#define ERRMSG_LEN 64
-
-struct xdp_errmsg {
-	char msg[ERRMSG_LEN];
-};
-
-struct {
-	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
-	__type(key, int);
-	__type(value, int);
-} xdp_errmsg_pb SEC(".maps");
-
-struct xdp_attach_error_ctx {
-	unsigned long unused;
-
-	/*
-	 * bpf does not support tracepoint __data_loc directly.
-	 *
-	 * Actually, this field is a 32 bit integer whose value encodes
-	 * information on where to find the actual data. The first 2 bytes is
-	 * the size of the data. The last 2 bytes is the offset from the start
-	 * of the tracepoint struct where the data begins.
-	 * -- https://github.com/iovisor/bpftrace/pull/1542
-	 */
-	__u32 msg; // __data_loc char[] msg;
-};
-
-/*
- * Catch the error message at the tracepoint.
- */
-
-SEC("tp/xdp/bpf_xdp_link_attach_failed")
-int tp__xdp__bpf_xdp_link_attach_failed(struct xdp_attach_error_ctx *ctx)
-{
-	char *msg = (void *)(__u64) ((void *) ctx + (__u16) ctx->msg);
-	struct xdp_errmsg errmsg = {};
-
-	bpf_probe_read_kernel_str(&errmsg.msg, ERRMSG_LEN, msg);
-	bpf_perf_event_output(ctx, &xdp_errmsg_pb, BPF_F_CURRENT_CPU, &errmsg,
-			      ERRMSG_LEN);
-	return 0;
-}
-
-/*
- * Reuse the XDP program in xdp_dummy.c.
- */
-
-char LICENSE[] SEC("license") = "GPL";
-- 
2.55.0

[PATCH bpf-next v4 4/6] libbpf: Factor out __sys_bpf_fd helper

[Leon Hwang]

In the next patch, it also needs to use the extended BPF syscall to
receive the reported log.

So, factor out __sys_bpf_fd helper.

No functional changes intended.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 tools/lib/bpf/bpf.c | 41 +++++++++++++++++++++++++----------------
 1 file changed, 25 insertions(+), 16 deletions(-)

diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index b49822d212ae..9a2107d4f6d8 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -203,6 +203,30 @@ int bump_rlimit_memlock(void)
 	return 0;
 }
 
+static int __sys_bpf_fd(union bpf_attr *attr, const size_t attr_sz, enum bpf_cmd cmd,
+			struct bpf_log_opts *log_opts)
+{
+	const size_t attr_common_sz = sizeof(struct bpf_common_attr);
+	struct bpf_common_attr attr_common;
+	int fd;
+
+	if (!OPTS_VALID(log_opts, bpf_log_opts))
+		return libbpf_err(-EINVAL);
+
+	if (log_opts && feat_supported(NULL, FEAT_BPF_SYSCALL_COMMON_ATTRS)) {
+		memset(&attr_common, 0, attr_common_sz);
+		attr_common.log_buf = ptr_to_u64(OPTS_GET(log_opts, buf, NULL));
+		attr_common.log_size = OPTS_GET(log_opts, size, 0);
+		attr_common.log_level = OPTS_GET(log_opts, level, 0);
+		fd = sys_bpf_ext_fd(cmd, attr, attr_sz, &attr_common, attr_common_sz);
+		OPTS_SET(log_opts, true_size, attr_common.log_true_size);
+	} else {
+		fd = sys_bpf_fd(cmd, attr, attr_sz);
+		OPTS_SET(log_opts, true_size, 0);
+	}
+	return fd;
+}
+
 int bpf_map_create(enum bpf_map_type map_type,
 		   const char *map_name,
 		   __u32 key_size,
@@ -211,8 +235,6 @@ int bpf_map_create(enum bpf_map_type map_type,
 		   const struct bpf_map_create_opts *opts)
 {
 	const size_t attr_sz = offsetofend(union bpf_attr, excl_prog_hash_size);
-	const size_t attr_common_sz = sizeof(struct bpf_common_attr);
-	struct bpf_common_attr attr_common;
 	struct bpf_log_opts *log_opts;
 	union bpf_attr attr;
 	int fd;
@@ -248,20 +270,7 @@ int bpf_map_create(enum bpf_map_type map_type,
 	attr.excl_prog_hash_size = OPTS_GET(opts, excl_prog_hash_size, 0);
 
 	log_opts = OPTS_GET(opts, log_opts, NULL);
-	if (!OPTS_VALID(log_opts, bpf_log_opts))
-		return libbpf_err(-EINVAL);
-
-	if (log_opts && feat_supported(NULL, FEAT_BPF_SYSCALL_COMMON_ATTRS)) {
-		memset(&attr_common, 0, attr_common_sz);
-		attr_common.log_buf = ptr_to_u64(OPTS_GET(log_opts, buf, NULL));
-		attr_common.log_size = OPTS_GET(log_opts, size, 0);
-		attr_common.log_level = OPTS_GET(log_opts, level, 0);
-		fd = sys_bpf_ext_fd(BPF_MAP_CREATE, &attr, attr_sz, &attr_common, attr_common_sz);
-		OPTS_SET(log_opts, true_size, attr_common.log_true_size);
-	} else {
-		fd = sys_bpf_fd(BPF_MAP_CREATE, &attr, attr_sz);
-		OPTS_SET(log_opts, true_size, 0);
-	}
+	fd = __sys_bpf_fd(&attr, attr_sz, BPF_MAP_CREATE, log_opts);
 	return libbpf_err_errno(fd);
 }
 
-- 
2.55.0

[PATCH bpf-next v4 5/6] libbpf: Add log_opts support for bpf_link_create

[Leon Hwang]

Since the iter_info and iter_info_len in struct bpf_link_create_opts are
legacy, reuse the slot of iter_info to place log_opts.

When adding log_opts support for iter link_create in the future, we will
move the iter_info and iter_info_len to the last union, see below. And,
keep the backward compatibility meanwhile, that uses iter_info if
iter_info_len is set.

struct bpf_link_create_opts {
	/* ... */
	union {
		/* ... */
		strut {
			struct bpf_iter_link_info *info;
			__u32 len;
		} iter;
	};
};

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 tools/lib/bpf/bpf.c | 20 +++++++++++++++++---
 tools/lib/bpf/bpf.h |  5 ++++-
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index 9a2107d4f6d8..00efa90a6ed9 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -794,6 +794,8 @@ int bpf_link_create(int prog_fd, int target_fd,
 {
 	const size_t attr_sz = offsetofend(union bpf_attr, link_create);
 	__u32 target_btf_id, iter_info_len, relative_id;
+	union bpf_iter_link_info *iter_info = NULL;
+	struct bpf_log_opts *log_opts = NULL;
 	int fd, err, relative_fd;
 	union bpf_attr attr;
 
@@ -803,6 +805,14 @@ int bpf_link_create(int prog_fd, int target_fd,
 	iter_info_len = OPTS_GET(opts, iter_info_len, 0);
 	target_btf_id = OPTS_GET(opts, target_btf_id, 0);
 
+	if (iter_info_len && attach_type != BPF_TRACE_ITER)
+		return libbpf_err(-EINVAL);
+
+	if (iter_info_len)
+		iter_info = OPTS_GET(opts, iter_info, (void *)0);
+	else
+		log_opts = OPTS_GET(opts, log_opts, (void *)0);
+
 	/* validate we don't have unexpected combinations of non-zero fields */
 	if (iter_info_len || target_btf_id) {
 		if (iter_info_len && target_btf_id)
@@ -824,7 +834,7 @@ int bpf_link_create(int prog_fd, int target_fd,
 
 	switch (attach_type) {
 	case BPF_TRACE_ITER:
-		attr.link_create.iter_info = ptr_to_u64(OPTS_GET(opts, iter_info, (void *)0));
+		attr.link_create.iter_info = ptr_to_u64(iter_info);
 		attr.link_create.iter_info_len = iter_info_len;
 		break;
 	case BPF_PERF_EVENT:
@@ -960,12 +970,12 @@ int bpf_link_create(int prog_fd, int target_fd,
 			return libbpf_err(-EINVAL);
 		break;
 	default:
-		if (!OPTS_ZEROED(opts, flags))
+		if (!OPTS_ZEROED(opts, iter_info_len))
 			return libbpf_err(-EINVAL);
 		break;
 	}
 proceed:
-	fd = sys_bpf_fd(BPF_LINK_CREATE, &attr, attr_sz);
+	fd = __sys_bpf_fd(&attr, attr_sz, BPF_LINK_CREATE, log_opts);
 	if (fd >= 0)
 		return fd;
 	/* we'll get EINVAL if LINK_CREATE doesn't support attaching fentry
@@ -975,6 +985,10 @@ int bpf_link_create(int prog_fd, int target_fd,
 	if (err != -EINVAL)
 		return libbpf_err(err);
 
+	/* bpf_raw_tracepoint_open() does not support log_opts */
+	if (log_opts)
+		return libbpf_err(err);
+
 	/* if user used features not supported by
 	 * BPF_RAW_TRACEPOINT_OPEN command, then just give up immediately
 	 */
diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
index 826d9cc9ab65..fe3b7fd8512b 100644
--- a/tools/lib/bpf/bpf.h
+++ b/tools/lib/bpf/bpf.h
@@ -422,7 +422,10 @@ union bpf_iter_link_info; /* defined in up-to-date linux/bpf.h */
 struct bpf_link_create_opts {
 	size_t sz; /* size of this struct for forward/backward compatibility */
 	__u32 flags;
-	union bpf_iter_link_info *iter_info;
+	union {
+		union bpf_iter_link_info *iter_info;
+		struct bpf_log_opts *log_opts;
+	};
 	__u32 iter_info_len;
 	__u32 target_btf_id;
 	union {
-- 
2.55.0

[PATCH bpf-next v4 6/6] selftests/bpf: Add tests to verify link_create logs

[Leon Hwang]

Add tests to verify the new logs in link_create and xdp link_create,
including a log reported via extack when fail to create an xdp link.

Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 .../selftests/bpf/prog_tests/xdp_link.c       | 102 ++++++++++++++++++
 1 file changed, 102 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_link.c b/tools/testing/selftests/bpf/prog_tests/xdp_link.c
index e7e9f3c22edf..d1bca773ca2f 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_link.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_link.c
@@ -150,3 +150,105 @@ void serial_test_xdp_link(void)
 	test_xdp_link__destroy(skel1);
 	test_xdp_link__destroy(skel2);
 }
+
+static void test_link_create(int prog_fd, int ifindex, enum bpf_attach_type attach_type,
+			     __u32 flags, int exp_err, const char *msg)
+{
+	char log_buf[128] = {};
+	LIBBPF_OPTS(bpf_log_opts, log_opts,
+		    .buf = log_buf,
+		    .size = sizeof(log_buf),
+		    .level = 1,
+	);
+	LIBBPF_OPTS(bpf_link_create_opts, opts,
+		    .flags = flags,
+		    .log_opts = &log_opts,
+	);
+	int fd;
+
+	fd = bpf_link_create(prog_fd, ifindex, attach_type, &opts);
+	if (!ASSERT_LT(fd, 0, "bpf_link_create")) {
+		close(fd);
+		return;
+	}
+
+	ASSERT_EQ(fd, exp_err, "fd");
+	ASSERT_STREQ(log_buf, msg, "log_buf");
+	ASSERT_EQ(log_opts.true_size, strlen(msg) + 1, "log_size");
+}
+
+static void test_link_create_invalid_prog_fd(void)
+{
+	const char *msg = "Invalid prog_fd.\n";
+
+	test_link_create(-1, IFINDEX_LO, BPF_XDP, 0, -EBADF, msg);
+}
+
+static void test_link_create_invalid_prog_type(void)
+{
+	const char *msg = "Invalid prog type.\n";
+	const struct bpf_insn insns[] = {
+		BPF_MOV64_IMM(BPF_REG_0, 0),
+		BPF_EXIT_INSN(),
+	};
+	int prog_fd;
+
+	prog_fd = bpf_prog_load(BPF_PROG_TYPE_LIRC_MODE2, NULL, "GPL", insns,
+				ARRAY_SIZE(insns), NULL);
+	if (!ASSERT_GE(prog_fd, 0, "bpf_prog_load"))
+		return;
+
+	test_link_create(prog_fd, 0, BPF_LIRC_MODE2, 0, -EINVAL, msg);
+
+	close(prog_fd);
+}
+
+static void test_link_create_attach(int ifindex, enum bpf_attach_type attach_type, __u32 flags,
+				    const char *msg)
+{
+	struct test_xdp_link *skel;
+
+	skel = test_xdp_link__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "test_xdp_link__open_and_load"))
+		return;
+
+	test_link_create(bpf_program__fd(skel->progs.xdp_handler), ifindex, attach_type, flags,
+			 -EINVAL, msg);
+
+	test_xdp_link__destroy(skel);
+}
+
+static void test_link_create_invalid_attach_type(void)
+{
+	const char *msg = "Invalid attach_type.\n";
+
+	test_link_create_attach(IFINDEX_LO, BPF_CGROUP_INET_INGRESS, 0, msg);
+}
+
+static void test_link_create_xdp_invalid_target_ifindex(void)
+{
+	const char *msg = "Invalid target_ifindex.\n";
+
+	test_link_create_attach(0, BPF_XDP, 0, msg);
+}
+
+static void test_link_create_xdp_extack(void)
+{
+	const char *msg = "Invalid XDP flags for BPF link attachment\n";
+
+	test_link_create_attach(IFINDEX_LO, BPF_XDP, XDP_FLAGS_REPLACE, msg);
+}
+
+void test_link_create_log(void)
+{
+	if (test__start_subtest("invalid_prog_fd"))
+		test_link_create_invalid_prog_fd();
+	if (test__start_subtest("invalid_prog_type"))
+		test_link_create_invalid_prog_type();
+	if (test__start_subtest("invalid_attach_type"))
+		test_link_create_invalid_attach_type();
+	if (test__start_subtest("xdp/invalid_target_ifindex"))
+		test_link_create_xdp_invalid_target_ifindex();
+	if (test__start_subtest("xdp/extack"))
+		test_link_create_xdp_extack();
+}
-- 
2.55.0

Re: [PATCH bpf-next v4 4/6] libbpf: Factor out __sys_bpf_fd helper

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 3334 bytes --]

> libbpf: Factor out __sys_bpf_fd helper

TL;DR: Nit only, not a bug: the new libbpf helper __sys_bpf_fd() has a
misleading name and a different argument order (cmd not first) than
sys_bpf_fd(); a name like sys_bpf_fd_log() is suggested.

> diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
> index b49822d212ae..9a2107d4f6d8 100644
> --- a/tools/lib/bpf/bpf.c
> +++ b/tools/lib/bpf/bpf.c
> @@ -203,6 +203,30 @@ int bump_rlimit_memlock(void)
>  	return 0;
>  }
>
> +static int __sys_bpf_fd(union bpf_attr *attr, const size_t attr_sz, enum bpf_cmd cmd,
> +			struct bpf_log_opts *log_opts)
> +{
> +	const size_t attr_common_sz = sizeof(struct bpf_common_attr);
> +	struct bpf_common_attr attr_common;
> +	int fd;
> +
> +	if (!OPTS_VALID(log_opts, bpf_log_opts))
> +		return libbpf_err(-EINVAL);
> +
> +	if (log_opts && feat_supported(NULL, FEAT_BPF_SYSCALL_COMMON_ATTRS)) {
> +		memset(&attr_common, 0, attr_common_sz);
> +		attr_common.log_buf = ptr_to_u64(OPTS_GET(log_opts, buf, NULL));
> +		attr_common.log_size = OPTS_GET(log_opts, size, 0);
> +		attr_common.log_level = OPTS_GET(log_opts, level, 0);
> +		fd = sys_bpf_ext_fd(cmd, attr, attr_sz, &attr_common, attr_common_sz);
> +		OPTS_SET(log_opts, true_size, attr_common.log_true_size);
> +	} else {
> +		fd = sys_bpf_fd(cmd, attr, attr_sz);
> +		OPTS_SET(log_opts, true_size, 0);
> +	}
> +	return fd;
> +}
> +

[ ... ]

> @@ -248,20 +270,7 @@ int bpf_map_create(enum bpf_map_type map_type,
>  	attr.excl_prog_hash_size = OPTS_GET(opts, excl_prog_hash_size, 0);
>
>  	log_opts = OPTS_GET(opts, log_opts, NULL);
> -	if (!OPTS_VALID(log_opts, bpf_log_opts))
> -		return libbpf_err(-EINVAL);
> -
> -	if (log_opts && feat_supported(NULL, FEAT_BPF_SYSCALL_COMMON_ATTRS)) {
> -		memset(&attr_common, 0, attr_common_sz);
> -		attr_common.log_buf = ptr_to_u64(OPTS_GET(log_opts, buf, NULL));
> -		attr_common.log_size = OPTS_GET(log_opts, size, 0);
> -		attr_common.log_level = OPTS_GET(log_opts, level, 0);
> -		fd = sys_bpf_ext_fd(BPF_MAP_CREATE, &attr, attr_sz, &attr_common, attr_common_sz);
> -		OPTS_SET(log_opts, true_size, attr_common.log_true_size);
> -	} else {
> -		fd = sys_bpf_fd(BPF_MAP_CREATE, &attr, attr_sz);
> -		OPTS_SET(log_opts, true_size, 0);
> -	}
> +	fd = __sys_bpf_fd(&attr, attr_sz, BPF_MAP_CREATE, log_opts);
>  	return libbpf_err_errno(fd);
>  }

This isn't a bug, but __sys_bpf_fd() is a higher-level wrapper that
dispatches to sys_bpf_fd() or sys_bpf_ext_fd() after validating log_opts and
probing FEAT_BPF_SYSCALL_COMMON_ATTRS, while a leading double underscore
usually marks the lower-level variant of a function.

The helper also takes (attr, attr_sz, cmd, log_opts), whereas sys_bpf(),
sys_bpf_fd(), sys_bpf_ext() and sys_bpf_ext_fd() all take cmd first, so the
new call reads differently from the nearby calls:

    fd = __sys_bpf_fd(&attr, attr_sz, BPF_MAP_CREATE, log_opts);

Would a name that describes what the helper adds (for example something like
sys_bpf_fd_log()), with cmd as the first argument like the other sys_bpf*()
wrappers, read more naturally next to sys_bpf_fd() and sys_bpf_ext_fd()?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/40108748084

Re: [PATCH bpf-next v4 5/6] libbpf: Add log_opts support for bpf_link_create

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 3514 bytes --]

> libbpf: Add log_opts support for bpf_link_create

TL;DR: In bpf_link_create(), the shared iter_info/log_opts slot is keyed only
on iter_info_len, so an iter_info pointer with len 0 may be misread as
log_opts, possibly causing out-of-bounds reads/writes in libbpf.

> diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
> index 9a2107d4f6d8..00efa90a6ed9 100644
> --- a/tools/lib/bpf/bpf.c
> +++ b/tools/lib/bpf/bpf.c

[ ... ]

> @@ -803,6 +805,14 @@ int bpf_link_create(int prog_fd, int target_fd,
>  	iter_info_len = OPTS_GET(opts, iter_info_len, 0);
>  	target_btf_id = OPTS_GET(opts, target_btf_id, 0);
>  
> +	if (iter_info_len && attach_type != BPF_TRACE_ITER)
> +		return libbpf_err(-EINVAL);
> +
> +	if (iter_info_len)
> +		iter_info = OPTS_GET(opts, iter_info, (void *)0);
> +	else
> +		log_opts = OPTS_GET(opts, log_opts, (void *)0);
> +
>  	/* validate we don't have unexpected combinations of non-zero fields */
>  	if (iter_info_len || target_btf_id) {
>  		if (iter_info_len && target_btf_id)

For BPF_TRACE_ITER, iter_info_len is now the only thing that decides whether
the shared iter_info/log_opts slot holds a union bpf_iter_link_info pointer
or a struct bpf_log_opts pointer.

Can a caller that sets opts->iter_info but leaves opts->iter_info_len at 0
end up with its union bpf_iter_link_info being read as a struct
bpf_log_opts here?

bpf_program__attach_iter() copies opts->link_info into
link_create_opts.iter_info and opts->link_info_len into iter_info_len
without checking that they agree, and nothing in bpf.h or libbpf.h says
log_opts is only used when iter_info_len == 0, or that iter_info needs
iter_info_len.

Before this patch the pointer went to the kernel, and bpf_iter_link_attach()
rejected the mismatch cleanly:

    if (bpfptr_is_null(ulinfo) ^ !linfo_len)
        return -EINVAL;

With this patch, __sys_bpf_fd() runs OPTS_VALID(log_opts, bpf_log_opts) on
the 16-byte union bpf_iter_link_info.  The first 8 bytes of that union
(map.map_fd, or task.tid/pid, or cgroup.order/cgroup_fd) become
log_opts->sz:

- If map_fd or tid is in the range 8..27, sz passes validation, and size and
  level are read from bytes 16..24, which lie past the end of the 16-byte
  object.

- If sz is 28 to 31, OPTS_HAS(log_opts, true_size) is true, so
  OPTS_SET(log_opts, true_size, ...) writes 4 bytes at offset 24, which is 8
  bytes past the end of the caller's object.  Can this corrupt the caller's
  stack or heap?

- If sz is larger (a typical tid, or a cgroup fd shifted into the high 32
  bits), libbpf_is_mem_zeroed() scans caller memory from offset 28 up to sz.
  It usually stops with a "bpf_log_opts has non-zero extra bytes" warning,
  but it reads out of bounds first.

In addition, attr.link_create.iter_info is now NULL with iter_info_len of 0,
which the kernel accepts.  If validation does pass, could a task iterator
attach to all tasks instead of the requested tid, and a map iterator fail
with -EBADF instead of -EINVAL?

The commit message says log_opts support for iter links is future work.
Would it be better to treat the slot as iter_info whenever
attach_type == BPF_TRACE_ITER, and read log_opts only for other attach
types, instead of keying only on iter_info_len?  That would keep the old
behaviour for iter links exactly.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/40108748084