On Thu, Jun 4, 2026 at 4:16 AM Mykyta Yatsenko
<[email protected]> wrote:
>
> On 6/4/26 4:10 AM, [email protected] wrote:
> > From: Yuan Chen <[email protected]>
> >
> > bpf_object__probe_loading() tries to load trivial SOCKET_FILTER and
> > TRACEPOINT programs to verify the BPF environment works. When a
> > BPF token is in use with restricted program type permissions, these
> > probe loads may fail because the token does not allow the specific
> > program types, even though BPF loading is perfectly functional.
> >
> > Fix by skipping the probe when a token FD is present: BPF token
> > creation itself proves the kernel has a working BPF subsystem.
> > Real BPF issues will be caught during actual program and map loading.
> >
> > Signed-off-by: Yuan Chen <[email protected]>
> > ---
> > tools/lib/bpf/libbpf.c | 10 +++-------
> > 1 file changed, 3 insertions(+), 7 deletions(-)
> >
> > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> > index ab2071fdd3e8..7e21c5eb9533 100644
> > --- a/tools/lib/bpf/libbpf.c
> > +++ b/tools/lib/bpf/libbpf.c
> > @@ -5167,12 +5167,8 @@ bpf_object__probe_loading(struct bpf_object *obj)
> > BPF_EXIT_INSN(),
> > };
> > int ret, insn_cnt = ARRAY_SIZE(insns);
> > - LIBBPF_OPTS(bpf_prog_load_opts, opts,
> > - .token_fd = obj->token_fd,
> > - .prog_flags = obj->token_fd ? BPF_F_TOKEN_FD : 0,
> > - );
> >
> > - if (obj->gen_loader)
> > + if (obj->gen_loader || obj->token_fd)
>
> This change makes sense, bpf_object__probe_loading() does very basic
> check that BPF works on a given kernel. In this case, when token is
> passed, this is ok to skip. An alternative, trying to make
> bpf_object__probe_loading() correctly token aware is worse.
>
> Acked-by: Mykyta Yatsenko <[email protected]>
This is the only patch in the series that makes sense to apply, but I
don't see this series in patchworks. Can you please resend just this
one to BPF mailing list? Thanks
>
> > return 0;
> >
> > ret = bump_rlimit_memlock();
> > @@ -5181,9 +5177,9 @@ bpf_object__probe_loading(struct bpf_object *obj)
> > errstr(ret));
> >
> > /* make sure basic loading works */
> > - ret = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", insns,
> > insn_cnt, &opts);
> > + ret = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, NULL, "GPL", insns,
> > insn_cnt, NULL);
> > if (ret < 0)
> > - ret = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL",
> > insns, insn_cnt, &opts);
> > + ret = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, NULL, "GPL",
> > insns, insn_cnt, NULL);
> > if (ret < 0) {
> > ret = errno;
> > pr_warn("Error in %s(): %s. Couldn't load trivial BPF
> > program. Make sure your kernel supports BPF (CONFIG_BPF_SYSCALL=y) and/or
> > that RLIMIT_MEMLOCK is set to big enough value.\n",
>
