mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 13:41:48 -04:00
Code Issues Packages Projects Releases Wiki Activity

selftests/bpf: Add tests for kprobe attachment with duplicate symbols

Browse Source 
bpf_fentry_shadow_test exists in both vmlinux (net/bpf/test_run.c) and
bpf_testmod (bpf_testmod.c), creating a duplicate symbol condition when
bpf_testmod is loaded. Add subtests that verify kprobe behavior with
this duplicate symbol:

In attach_probe:
- dup-sym-{default,legacy,perf,link}: unqualified attach succeeds
  across all four modes, preferring vmlinux over module shadow.
- MOD:SYM qualification attaches to the module version.

In kprobe_multi_test:
- dup_sym: kprobe_multi attach with kprobe and kretprobe succeeds.

bpf_fentry_shadow_test is not invoked via test_run, so tests verify
attach and detach succeed without triggering the probe.

Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
Link: https://lore.kernel.org/r/20260407203912.1787502-3-andrey.grodzovsky@crowdstrike.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Andrey Grodzovsky
2026-04-07 16:39:12 -04:00
committed by Alexei Starovoitov
parent 1870ddcd94
commit cea4323f1c
2 changed files with 109 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
tools/testing/selftests/bpf/prog_tests/attach_probe.c
View File

@@ -197,6 +197,66 @@ static void test_attach_kprobe_legacy_by_addr_reject(void)
test_attach_probe_manual__destroy(skel);
}
/*
* bpf_fentry_shadow_test exists in both vmlinux (net/bpf/test_run.c) and
* bpf_testmod (bpf_testmod.c). When bpf_testmod is loaded the symbol is
* duplicated. Test that kprobe attachment handles this correctly:
* - Unqualified name ("bpf_fentry_shadow_test") attaches to vmlinux.
* - MOD:SYM name ("bpf_testmod:bpf_fentry_shadow_test") attaches to module.
*
* Note: bpf_fentry_shadow_test is not invoked via test_run, so we only
* verify that attach and detach succeed without triggering the probe.
*/
static void test_attach_probe_dup_sym(enum probe_attach_mode attach_mode)
{
DECLARE_LIBBPF_OPTS(bpf_kprobe_opts, kprobe_opts);
struct bpf_link *kprobe_link, *kretprobe_link;
struct test_attach_probe_manual *skel;
skel = test_attach_probe_manual__open_and_load();
if (!ASSERT_OK_PTR(skel, "skel_dup_sym_open_and_load"))
return;
kprobe_opts.attach_mode = attach_mode;
/* Unqualified: should attach to vmlinux symbol */
kprobe_opts.retprobe = false;
kprobe_link = bpf_program__attach_kprobe_opts(skel->progs.handle_kprobe,
"bpf_fentry_shadow_test",
&kprobe_opts);
if (!ASSERT_OK_PTR(kprobe_link, "attach_kprobe_vmlinux"))
goto cleanup;
bpf_link__destroy(kprobe_link);
kprobe_opts.retprobe = true;
kretprobe_link = bpf_program__attach_kprobe_opts(skel->progs.handle_kretprobe,
"bpf_fentry_shadow_test",
&kprobe_opts);
if (!ASSERT_OK_PTR(kretprobe_link, "attach_kretprobe_vmlinux"))
goto cleanup;
bpf_link__destroy(kretprobe_link);
/* MOD:SYM qualified: should attach to module symbol */
kprobe_opts.retprobe = false;
kprobe_link = bpf_program__attach_kprobe_opts(skel->progs.handle_kprobe,
"bpf_testmod:bpf_fentry_shadow_test",
&kprobe_opts);
if (!ASSERT_OK_PTR(kprobe_link, "attach_kprobe_module"))
goto cleanup;
bpf_link__destroy(kprobe_link);
kprobe_opts.retprobe = true;
kretprobe_link = bpf_program__attach_kprobe_opts(skel->progs.handle_kretprobe,
"bpf_testmod:bpf_fentry_shadow_test",
&kprobe_opts);
if (!ASSERT_OK_PTR(kretprobe_link, "attach_kretprobe_module"))
goto cleanup;
bpf_link__destroy(kretprobe_link);
cleanup:
test_attach_probe_manual__destroy(skel);
}
/* attach uprobe/uretprobe long event name testings */
static void test_attach_uprobe_long_event_name(void)
{
@@ -559,6 +619,15 @@ void test_attach_probe(void)
if (test__start_subtest("kprobe-legacy-by-addr-reject"))
test_attach_kprobe_legacy_by_addr_reject();
if (test__start_subtest("dup-sym-default"))
test_attach_probe_dup_sym(PROBE_ATTACH_MODE_DEFAULT);
if (test__start_subtest("dup-sym-legacy"))
test_attach_probe_dup_sym(PROBE_ATTACH_MODE_LEGACY);
if (test__start_subtest("dup-sym-perf"))
test_attach_probe_dup_sym(PROBE_ATTACH_MODE_PERF);
if (test__start_subtest("dup-sym-link"))
test_attach_probe_dup_sym(PROBE_ATTACH_MODE_LINK);
if (test__start_subtest("auto"))
test_attach_probe_auto(skel);
if (test__start_subtest("kprobe-sleepable"))

40
tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
View File

@@ -633,6 +633,44 @@ static void test_attach_write_ctx(void)
}
#endif
/*
* Test kprobe_multi handles shadow symbols (vmlinux + module duplicate).
* bpf_fentry_shadow_test exists in both vmlinux and bpf_testmod.
* kprobe_multi resolves via ftrace_lookup_symbols() which finds the
* vmlinux symbol first and stops, so this should always succeed.
*/
static void test_attach_probe_dup_sym(void)
{
LIBBPF_OPTS(bpf_kprobe_multi_opts, opts);
const char *syms[1] = { "bpf_fentry_shadow_test" };
struct kprobe_multi *skel = NULL;
struct bpf_link *link1 = NULL, *link2 = NULL;
skel = kprobe_multi__open_and_load();
if (!ASSERT_OK_PTR(skel, "kprobe_multi__open_and_load"))
goto cleanup;
skel->bss->pid = getpid();
opts.syms = syms;
opts.cnt = ARRAY_SIZE(syms);
link1 = bpf_program__attach_kprobe_multi_opts(skel->progs.test_kprobe_manual,
NULL, &opts);
if (!ASSERT_OK_PTR(link1, "attach_kprobe_multi_dup_sym"))
goto cleanup;
opts.retprobe = true;
link2 = bpf_program__attach_kprobe_multi_opts(skel->progs.test_kretprobe_manual,
NULL, &opts);
if (!ASSERT_OK_PTR(link2, "attach_kretprobe_multi_dup_sym"))
goto cleanup;
cleanup:
bpf_link__destroy(link2);
bpf_link__destroy(link1);
kprobe_multi__destroy(skel);
}
void serial_test_kprobe_multi_bench_attach(void)
{
if (test__start_subtest("kernel"))
@@ -676,5 +714,7 @@ void test_kprobe_multi_test(void)
test_unique_match();
if (test__start_subtest("attach_write_ctx"))
test_attach_write_ctx();
if (test__start_subtest("dup_sym"))
test_attach_probe_dup_sym();
RUN_TESTS(kprobe_multi_verifier);
}