btf: use line info to annotate poisoned CO-RE relocations

Add a line info when poisoning an instruction to make the
action explicit in the verifier log. Given a program like:

    ; return bpf_core_enum_value(enum nonexist_enum, NON_EXIST);
    0: LdImmDW dst: r0 imm: 1
    2: Exit

The verifier output now is:

    0: R1=ctx(off=0,imm=0) R10=fp0
    ; instruction poisoned by CO-RE
    0: (18) r10 = 0xbad2310
    frame pointer is read only

Signed-off-by: Lorenz Bauer <[email protected]>

Author: lmb

btf/core.go

@@ -54,6 +54,18 @@ func (f *COREFixup) Apply(ins *asm.Instruction) error {
 			// Replace all single size instruction with a invalid call instruction.
 			*ins = asm.BuiltinFunc(COREBadRelocationSentinel).Call()
 		}
+
+		// Add context to the kernel verifier output.
+		if source := ins.Source(); source != nil {
+			*ins = ins.WithSource(&Line{
+				line: fmt.Sprintf("instruction poisoned by CO-RE: %s", source),
+			})
+		} else {
+			*ins = ins.WithSource(&Line{
+				line: "instruction poisoned by CO-RE",
+			})
+		}
+
 		return nil
 	}
 

btf/core_reloc_test.go

@@ -1,15 +1,19 @@
 package btf_test
 
 import (
+	"bytes"
 	"io"
 	"os"
+	"slices"
 	"strings"
 	"testing"
 
 	"github.com/cilium/ebpf"
 	"github.com/cilium/ebpf/btf"
 	"github.com/cilium/ebpf/internal"
 	"github.com/cilium/ebpf/internal/testutils"
+
+	"github.com/go-quicktest/qt"
 )
 
 func TestCORERelocationLoad(t *testing.T) {
@@ -121,3 +125,42 @@ func TestLD64IMMReloc(t *testing.T) {
 	}
 	defer coll.Close()
 }
+
+func TestCOREPoisonLineInfo(t *testing.T) {
+	testutils.SkipOnOldKernel(t, "5.0", "program ext_infos")
+
+	spec, err := ebpf.LoadCollectionSpec(testutils.NativeFile(t, "../testdata/errors-%s.elf"))
+	qt.Assert(t, qt.IsNil(err))
+
+	var b btf.Builder
+	raw, err := b.Marshal(nil, nil)
+	qt.Assert(t, qt.IsNil(err))
+	empty, err := btf.LoadSpecFromReader(bytes.NewReader(raw))
+	qt.Assert(t, qt.IsNil(err))
+
+	for _, test := range []struct {
+		name string
+	}{
+		{"poisoned_single"},
+		{"poisoned_double"},
+	} {
+		progSpec := spec.Programs[test.name]
+		qt.Assert(t, qt.IsNotNil(progSpec))
+
+		t.Run(test.name, func(t *testing.T) {
+			t.Log(progSpec.Instructions)
+			_, err := ebpf.NewProgramWithOptions(progSpec, ebpf.ProgramOptions{
+				KernelTypes: empty,
+			})
+			testutils.SkipIfNotSupported(t, err)
+
+			var ve *ebpf.VerifierError
+			qt.Assert(t, qt.ErrorAs(err, &ve))
+			found := slices.ContainsFunc(ve.Log, func(line string) bool {
+				return strings.HasPrefix(line, "; instruction poisoned by CO-RE")
+			})
+			qt.Assert(t, qt.IsTrue(found))
+			t.Logf("%-5v", ve)
+		})
+	}
+}