Re: [RFC PATCH bpf-next v3 2/3] libbpf: Add FEAT_KPROBE_MULTI_LINK feature probe.

[bot+bpf-ci]

> diff --git a/tools/lib/bpf/features.c b/tools/lib/bpf/features.c
> index 4f19a0d79b0c..01ded8a1e3c4 100644
> --- a/tools/lib/bpf/features.c
> +++ b/tools/lib/bpf/features.c
> @@ -424,6 +424,41 @@ static int probe_uprobe_multi_link(int token_fd)
>  	return link_fd < 0 && err == -EINVAL;
>  }
>
> +static int probe_kprobe_multi_link(int token_fd)
> +{

[ ... ]

> +	/* attaching to a valid symbol should succeed */

The operation is designed to fail with E2BIG (the count is intentionally
set above MAX_KPROBE_MULTI_CNT). Should this comment say something like
"use a stable, always-present symbol" instead? As written, it reads like
the attach is expected to succeed, which contradicts the comment two
lines below about making it fail.

> +	link_opts.kprobe_multi.syms = &sym;
> +	/* MAX_KPROBE_MULTI_CNT is defined as (1U << 20) in kernel/trace/bpf_trace.c,
> +	 * so we create one more than the allowed limit to make it fail with E2BIG.
> +	 */
> +	link_opts.kprobe_multi.cnt = (1U << 20) + 1;
> +	link_fd = bpf_link_create(prog_fd, -1, BPF_TRACE_KPROBE_MULTI, &link_opts);
> +	err = -errno;
> +	if (link_fd >= 0)
> +		close(link_fd);
> +	close(prog_fd);
> +	/* Fails with E2BIG on kernels where kprobe_multi is supported */
> +	return link_fd <= 0 && err == -E2BIG;
                    ^^^^

Should this be "link_fd < 0" rather than "link_fd <= 0"?  The
reference function probe_uprobe_multi_link() just above uses
"link_fd < 0 && err == -EINVAL" for the same pattern.  fd 0 is
a valid file descriptor, so "<= 0" treats a successful fd 0 as
a failure.  In practice bpf_link_create() goes through
ensure_good_fd() which dup's fds below 3, so fd 0 cannot be
returned, but the check is still inconsistent with the
existing code pattern.

> +}

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/23947048141