Re: [PATCH bpf-next v1 14/14] selftests/bpf: Test pseudo-function policy diagnostics

> Load a socket-filter program that passes a callback to bpf_loop() without
> making a BPF-to-BPF call. Verify that the privileged load succeeds and the
> unprivileged Policy report identifies the BPF function reference at its
> ldimm64 instruction.

This isn't a bug, but the changelog says the report is verified to identify
the reference "at its ldimm64 instruction", though the added test asserts no
location at all -- only the three wording substrings.

Looking at the verification flow, prog->aux->linfo is assigned by
check_btf_line() in kernel/bpf/check_btf.c, reached from
bpf_check_btf_info() at kernel/bpf/verifier.c:21164, which runs after
add_subprogs() at line 21157. So bpf_find_linfo() returns NULL and
bpf_diag_source() takes its fallback branch, emitting a bare "insn %u" with
no function/file/line and no Source context block.

Would it be worth either asserting the instruction location the changelog
mentions, or softening the wording -- given that linfo is not yet parsed
when add_subprogs() runs, the "At" section here can only print a bare
insn N?

> diff --git a/tools/testing/selftests/bpf/progs/verifier_unpriv.c b/tools/testing/selftests/bpf/progs/verifier_unpriv.c
> index 42de5cff7e52..3069e70fbcbd 100644
> --- a/tools/testing/selftests/bpf/progs/verifier_unpriv.c
> +++ b/tools/testing/selftests/bpf/progs/verifier_unpriv.c
> @@ -96,6 +96,24 @@ __naked void pseudo_btf_id_log_masks_address(void)
>  	: __clobber_all);
>  }
>
> +static int pseudo_func_callback(__u32 index, void *ctx)
> +{
> +	return 0;
> +}
> +
> +SEC("socket")
> +__description("unpriv: pseudo function policy diagnostic")
> +__success __failure_unpriv
> +__msg_unpriv("loading/calling other bpf or kernel functions")
> +__not_msg_unpriv("BPF-to-BPF function call")
> +__msg_unpriv("policy check failed for BPF function reference")
> +__msg_unpriv("avoid BPF function references in unprivileged")
> +int unpriv_pseudo_func_policy(void *ctx)
> +{
> +	bpf_loop(1, pseudo_func_callback, NULL, 0);
> +	return 0;
> +}
> +
>  SEC("socket")
>  __description("unpriv: return pointer")
>  __success __failure_unpriv __msg_unpriv("R0 leaks addr")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31921026518