On Mon, Apr 06, 2026 at 03:31:58PM -0400, Andrey Grodzovsky wrote:
SNIP
> +static void test_attach_probe_dup_sym(enum probe_attach_mode attach_mode)
> +{
> + DECLARE_LIBBPF_OPTS(bpf_kprobe_opts, kprobe_opts);
> + struct bpf_link *kprobe_link, *kretprobe_link;
> + struct test_attach_probe_manual *skel;
> + int err;
> +
> + /* Load module with duplicate symbol */
> + err = load_module("bpf_testmod_dup_sym.ko", false);
> + if (!ASSERT_OK(err, "load_bpf_testmod_dup_sym")) {
> + test__skip();
> + return;
> + }
> +
> + skel = test_attach_probe_manual__open_and_load();
> + if (!ASSERT_OK_PTR(skel, "skel_dup_sym_open_and_load"))
> + goto unload_module;
> +
> + /* manual-attach kprobe/kretprobe with duplicate symbol present */
> + kprobe_opts.attach_mode = attach_mode;
> + kprobe_opts.retprobe = false;
> + kprobe_link = bpf_program__attach_kprobe_opts(skel->progs.handle_kprobe,
> + SYS_NANOSLEEP_KPROBE_NAME,
> + &kprobe_opts);
> + if (!ASSERT_OK_PTR(kprobe_link, "attach_kprobe_dup_sym"))
> + goto cleanup;
> + skel->links.handle_kprobe = kprobe_link;
> +
> + kprobe_opts.retprobe = true;
> + kretprobe_link =
> bpf_program__attach_kprobe_opts(skel->progs.handle_kretprobe,
> +
> SYS_NANOSLEEP_KPROBE_NAME,
> + &kprobe_opts);
maybe add tests for attaching the shadow module function as well?
> diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod_dup_sym.c
> b/tools/testing/selftests/bpf/test_kmods/bpf_testmod_dup_sym.c
> new file mode 100644
> index 000000000000..0e12f68afe3a
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod_dup_sym.c
> @@ -0,0 +1,48 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2025 CrowdStrike */
> +/* Test module for duplicate kprobe symbol handling */
> +#include <linux/init.h>
> +#include <linux/module.h>
> +#include <linux/kernel.h>
> +
> +/* Duplicate symbol to test kprobe attachment with duplicate symbols.
> + * This creates a duplicate of the syscall wrapper used in attach_probe
> tests.
> + * The libbpf fix should handle this by preferring the vmlinux symbol.
> + * This function should NEVER be called - kprobes should attach to vmlinux
> version.
> + */
> +#ifdef __x86_64__
> +int __x64_sys_nanosleep(void);
> +noinline int __x64_sys_nanosleep(void)
> +#elif defined(__s390x__)
> +int __s390x_sys_nanosleep(void);
> +noinline int __s390x_sys_nanosleep(void)
> +#elif defined(__aarch64__)
> +int __arm64_sys_nanosleep(void);
> +noinline int __arm64_sys_nanosleep(void)
> +#elif defined(__riscv)
> +int __riscv_sys_nanosleep(void);
> +noinline int __riscv_sys_nanosleep(void)
> +#else
> +int sys_nanosleep(void);
> +noinline int sys_nanosleep(void)
> +#endif
could we use module_fentry_shadow instead? it's in kernel and in bpf_testmod
for fentry shadowing test.. it's not executed via test_run but it could be
added or we just don't run it
jirka
> +{
> + WARN_ONCE(1, "bpf_testmod_dup_sym: dummy nanosleep symbol called - this
> should never execute!\n");
> + return -EINVAL;
> +}
> +
> +static int __init bpf_testmod_dup_sym_init(void)
> +{
> + return 0;
> +}
> +
> +static void __exit bpf_testmod_dup_sym_exit(void)
> +{
> +}
> +
> +module_init(bpf_testmod_dup_sym_init);
> +module_exit(bpf_testmod_dup_sym_exit);
> +
> +MODULE_AUTHOR("Andrey Grodzovsky");
> +MODULE_DESCRIPTION("BPF selftest duplicate symbol module");
> +MODULE_LICENSE("GPL");
> --
> 2.34.1
>
