Re: [RFC PATCH bpf-next v3 2/3] libbpf: Add FEAT_KPROBE_MULTI_LINK feature probe.

[Varun R Mallya]

On Fri, Apr 03, 2026 at 01:22:37PM +0000, bot+bpf-ci@xxxxxxxxxx wrote:
> > diff --git a/tools/lib/bpf/features.c b/tools/lib/bpf/features.c
> > index 4f19a0d79b0c..01ded8a1e3c4 100644
> > --- a/tools/lib/bpf/features.c
> > +++ b/tools/lib/bpf/features.c
> > @@ -424,6 +424,41 @@ static int probe_uprobe_multi_link(int token_fd)
> >  	return link_fd < 0 && err == -EINVAL;
> >  }
> >
> > +static int probe_kprobe_multi_link(int token_fd)
> > +{
> 
> [ ... ]
> 
> > +	/* attaching to a valid symbol should succeed */
> 
> The operation is designed to fail with E2BIG (the count is intentionally
> set above MAX_KPROBE_MULTI_CNT). Should this comment say something like
> "use a stable, always-present symbol" instead? As written, it reads like
> the attach is expected to succeed, which contradicts the comment two
> lines below about making it fail.

Yeah, I should be clarifying that. This is a nit though.

> > +	link_opts.kprobe_multi.syms = &sym;
> > +	/* MAX_KPROBE_MULTI_CNT is defined as (1U << 20) in kernel/trace/bpf_trace.c,
> > +	 * so we create one more than the allowed limit to make it fail with E2BIG.
> > +	 */
> > +	link_opts.kprobe_multi.cnt = (1U << 20) + 1;
> > +	link_fd = bpf_link_create(prog_fd, -1, BPF_TRACE_KPROBE_MULTI, &link_opts);
> > +	err = -errno;
> > +	if (link_fd >= 0)
> > +		close(link_fd);
> > +	close(prog_fd);
> > +	/* Fails with E2BIG on kernels where kprobe_multi is supported */
> > +	return link_fd <= 0 && err == -E2BIG;
>                     ^^^^
> 
> Should this be "link_fd < 0" rather than "link_fd <= 0"?  The
> reference function probe_uprobe_multi_link() just above uses
> "link_fd < 0 && err == -EINVAL" for the same pattern.  fd 0 is
> a valid file descriptor, so "<= 0" treats a successful fd 0 as
> a failure.  In practice bpf_link_create() goes through
> ensure_good_fd() which dup's fds below 3, so fd 0 cannot be
> returned, but the check is still inconsistent with the
> existing code pattern.

Good catch. I'll fix this in the next version after I get more reviews on this.

> > +}
> 
> [ ... ]
> 
> 
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
> 
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/23947048141