selftests/bpf: Add tests for kprobe attachment with duplicate symbols

bpf_fentry_shadow_test exists in both vmlinux (net/bpf/test_run.c) and
bpf_testmod (bpf_testmod.c), creating a duplicate symbol condition when
bpf_testmod is loaded. Add subtests that verify kprobe behavior with
this duplicate symbol:

In attach_probe:
- dup-sym-{default,legacy,perf,link}: unqualified attach succeeds
  across all four modes, preferring vmlinux over module shadow.
- MOD:SYM qualification attaches to the module version.

In kprobe_multi_test:
- dup_sym: kprobe_multi attach with kprobe and kretprobe succeeds.

bpf_fentry_shadow_test is not invoked via test_run, so tests verify
attach and detach succeed without triggering the probe.

Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
Link: https://lore.kernel.org/r/20260407203912.1787502-3-andrey.grodzovsky@crowdstrike.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/prog_tests/attach_probe.c b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
index 12a841afda6860441ee161c9e1cb9e213f11ba1e..e8c1a619e330e23cbaa058a7ce02e6eedb42ee24 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/attach_probe.c
+++ b/tools/testing/selftests/bpf/prog_tests/attach_probe.c
@@ -197,6 +197,66 @@ static void test_attach_kprobe_legacy_by_addr_reject(void)
        test_attach_probe_manual__destroy(skel);
 }
 
+/*
+ * bpf_fentry_shadow_test exists in both vmlinux (net/bpf/test_run.c) and
+ * bpf_testmod (bpf_testmod.c). When bpf_testmod is loaded the symbol is
+ * duplicated. Test that kprobe attachment handles this correctly:
+ * - Unqualified name ("bpf_fentry_shadow_test") attaches to vmlinux.
+ * - MOD:SYM name ("bpf_testmod:bpf_fentry_shadow_test") attaches to module.
+ *
+ * Note: bpf_fentry_shadow_test is not invoked via test_run, so we only
+ * verify that attach and detach succeed without triggering the probe.
+ */
+static void test_attach_probe_dup_sym(enum probe_attach_mode attach_mode)
+{
+       DECLARE_LIBBPF_OPTS(bpf_kprobe_opts, kprobe_opts);
+       struct bpf_link *kprobe_link, *kretprobe_link;
+       struct test_attach_probe_manual *skel;
+
+       skel = test_attach_probe_manual__open_and_load();
+       if (!ASSERT_OK_PTR(skel, "skel_dup_sym_open_and_load"))
+               return;
+
+       kprobe_opts.attach_mode = attach_mode;
+
+       /* Unqualified: should attach to vmlinux symbol */
+       kprobe_opts.retprobe = false;
+       kprobe_link = bpf_program__attach_kprobe_opts(skel->progs.handle_kprobe,
+                                                     "bpf_fentry_shadow_test",
+                                                     &kprobe_opts);
+       if (!ASSERT_OK_PTR(kprobe_link, "attach_kprobe_vmlinux"))
+               goto cleanup;
+       bpf_link__destroy(kprobe_link);
+
+       kprobe_opts.retprobe = true;
+       kretprobe_link = bpf_program__attach_kprobe_opts(skel->progs.handle_kretprobe,
+                                                        "bpf_fentry_shadow_test",
+                                                        &kprobe_opts);
+       if (!ASSERT_OK_PTR(kretprobe_link, "attach_kretprobe_vmlinux"))
+               goto cleanup;
+       bpf_link__destroy(kretprobe_link);
+
+       /* MOD:SYM qualified: should attach to module symbol */
+       kprobe_opts.retprobe = false;
+       kprobe_link = bpf_program__attach_kprobe_opts(skel->progs.handle_kprobe,
+                                                     "bpf_testmod:bpf_fentry_shadow_test",
+                                                     &kprobe_opts);
+       if (!ASSERT_OK_PTR(kprobe_link, "attach_kprobe_module"))
+               goto cleanup;
+       bpf_link__destroy(kprobe_link);
+
+       kprobe_opts.retprobe = true;
+       kretprobe_link = bpf_program__attach_kprobe_opts(skel->progs.handle_kretprobe,
+                                                        "bpf_testmod:bpf_fentry_shadow_test",
+                                                        &kprobe_opts);
+       if (!ASSERT_OK_PTR(kretprobe_link, "attach_kretprobe_module"))
+               goto cleanup;
+       bpf_link__destroy(kretprobe_link);
+
+cleanup:
+       test_attach_probe_manual__destroy(skel);
+}
+
 /* attach uprobe/uretprobe long event name testings */
 static void test_attach_uprobe_long_event_name(void)
 {
@@ -559,6 +619,15 @@ void test_attach_probe(void)
        if (test__start_subtest("kprobe-legacy-by-addr-reject"))
                test_attach_kprobe_legacy_by_addr_reject();
 
+       if (test__start_subtest("dup-sym-default"))
+               test_attach_probe_dup_sym(PROBE_ATTACH_MODE_DEFAULT);
+       if (test__start_subtest("dup-sym-legacy"))
+               test_attach_probe_dup_sym(PROBE_ATTACH_MODE_LEGACY);
+       if (test__start_subtest("dup-sym-perf"))
+               test_attach_probe_dup_sym(PROBE_ATTACH_MODE_PERF);
+       if (test__start_subtest("dup-sym-link"))
+               test_attach_probe_dup_sym(PROBE_ATTACH_MODE_LINK);
+
        if (test__start_subtest("auto"))
                test_attach_probe_auto(skel);
        if (test__start_subtest("kprobe-sleepable"))

diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
index 78c974d4ea33aaf640f7f6365729cd530f519e1d..20ddff6812e986654c7658788a371e1ea738554d 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
@@ -633,6 +633,44 @@ static void test_attach_write_ctx(void)
 }
 #endif
 
+/*
+ * Test kprobe_multi handles shadow symbols (vmlinux + module duplicate).
+ * bpf_fentry_shadow_test exists in both vmlinux and bpf_testmod.
+ * kprobe_multi resolves via ftrace_lookup_symbols() which finds the
+ * vmlinux symbol first and stops, so this should always succeed.
+ */
+static void test_attach_probe_dup_sym(void)
+{
+       LIBBPF_OPTS(bpf_kprobe_multi_opts, opts);
+       const char *syms[1] = { "bpf_fentry_shadow_test" };
+       struct kprobe_multi *skel = NULL;
+       struct bpf_link *link1 = NULL, *link2 = NULL;
+
+       skel = kprobe_multi__open_and_load();
+       if (!ASSERT_OK_PTR(skel, "kprobe_multi__open_and_load"))
+               goto cleanup;
+
+       skel->bss->pid = getpid();
+       opts.syms = syms;
+       opts.cnt = ARRAY_SIZE(syms);
+
+       link1 = bpf_program__attach_kprobe_multi_opts(skel->progs.test_kprobe_manual,
+                                                     NULL, &opts);
+       if (!ASSERT_OK_PTR(link1, "attach_kprobe_multi_dup_sym"))
+               goto cleanup;
+
+       opts.retprobe = true;
+       link2 = bpf_program__attach_kprobe_multi_opts(skel->progs.test_kretprobe_manual,
+                                                     NULL, &opts);
+       if (!ASSERT_OK_PTR(link2, "attach_kretprobe_multi_dup_sym"))
+               goto cleanup;
+
+cleanup:
+       bpf_link__destroy(link2);
+       bpf_link__destroy(link1);
+       kprobe_multi__destroy(skel);
+}
+
 void serial_test_kprobe_multi_bench_attach(void)
 {
        if (test__start_subtest("kernel"))
@@ -676,5 +714,7 @@ void test_kprobe_multi_test(void)
                test_unique_match();
        if (test__start_subtest("attach_write_ctx"))
                test_attach_write_ctx();
+       if (test__start_subtest("dup_sym"))
+               test_attach_probe_dup_sym();
        RUN_TESTS(kprobe_multi_verifier);
 }