linux-kernel - Re: [PATCH bpf-next v4 4/4] selftests/bpf: Add tests to verify freeing the special fields when update hash and local storage maps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <02b8c4ba-eb24-41e2-813c-98b83561ef9d@linux.dev>
Date: Tue, 4 Nov 2025 09:30:27 -0800
From: Yonghong Song <yonghong.song@...ux.dev>
To: Leon Hwang <leon.hwang@...ux.dev>, bpf@...r.kernel.org
Cc: ast@...nel.org, andrii@...nel.org, daniel@...earbox.net,
 martin.lau@...ux.dev, eddyz87@...il.com, song@...nel.org,
 john.fastabend@...il.com, kpsingh@...nel.org, sdf@...ichev.me,
 haoluo@...gle.com, jolsa@...nel.org, memxor@...il.com, ameryhung@...il.com,
 linux-kernel@...r.kernel.org, kernel-patches-bot@...com
Subject: Re: [PATCH bpf-next v4 4/4] selftests/bpf: Add tests to verify
 freeing the special fields when update hash and local storage maps



On 10/30/25 8:24 AM, Leon Hwang wrote:
> Add tests to verify that updating hash and local storage maps decrements
> refcount when BPF_KPTR_REF objects are involved.
>
> The tests perform the following steps:
>
> 1. Call update_elem() to insert an initial value.
> 2. Use bpf_refcount_acquire() to increment the refcount.
> 3. Store the node pointer in the map value.
> 4. Add the node to a linked list.
> 5. Probe-read the refcount and verify it is *2*.
> 6. Call update_elem() again to trigger refcount decrement.
> 7. Probe-read the refcount and verify it is *1*.
>
> Signed-off-by: Leon Hwang <leon.hwang@...ux.dev>

I applied this patch only (i.e., not including patches 1/2/3) to master
branch and do bpf selftest and all tests succeeded.

[root@...h-fb-vm1 bpf]# ./test_progs -t refcounted_kptr
#294/1   refcounted_kptr/insert_read_both: remove from tree + list:OK
...
#294/18  refcounted_kptr/pcpu_hash_refcount_leak:OK
#294/19  refcounted_kptr/check_pcpu_hash_refcount:OK
#294/20  refcounted_kptr/hash_lock_refcount_leak:OK
#294/21  refcounted_kptr/check_hash_lock_refcount:OK
#294/22  refcounted_kptr/rbtree_sleepable_rcu:OK
#294/23  refcounted_kptr/rbtree_sleepable_rcu_no_explicit_rcu_lock:OK
#294/24  refcounted_kptr/cgroup_storage_lock_refcount_leak:OK
#294/25  refcounted_kptr/check_cgroup_storage_lock_refcount:OK
...

Did I miss anything?

> ---
>   .../bpf/prog_tests/refcounted_kptr.c          | 134 +++++++++++++++++-
>   .../selftests/bpf/progs/refcounted_kptr.c     | 129 +++++++++++++++++
>   2 files changed, 262 insertions(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c b/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c
> index d6bd5e16e6372..0ec91ff914af7 100644
> --- a/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c
> +++ b/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c
> @@ -3,7 +3,7 @@
>   
>   #include <test_progs.h>
>   #include <network_helpers.h>
> -
> +#include "cgroup_helpers.h"
>   #include "refcounted_kptr.skel.h"
>   #include "refcounted_kptr_fail.skel.h"
>   
> @@ -44,3 +44,135 @@ void test_refcounted_kptr_wrong_owner(void)
>   	ASSERT_OK(opts.retval, "rbtree_wrong_owner_remove_fail_a2 retval");
>   	refcounted_kptr__destroy(skel);
>   }
> +
> +static void test_refcnt_leak(struct refcounted_kptr *skel, int key, void *values, size_t values_sz,
> +			     u64 flags, struct bpf_map *map, struct bpf_program *prog_leak,
> +			     struct bpf_program *prog_check, struct bpf_test_run_opts *opts)
> +{
> +	int ret, fd;
> +
> +	ret = bpf_map__update_elem(map, &key, sizeof(key), values, values_sz, flags);
> +	if (!ASSERT_OK(ret, "bpf_map__update_elem init"))
> +		return;
> +
> +	fd = bpf_program__fd(prog_leak);
> +	ret = bpf_prog_test_run_opts(fd, opts);
> +	if (!ASSERT_OK(ret, "bpf_prog_test_run_opts"))
> +		return;
> +	if (!ASSERT_EQ(skel->bss->kptr_refcount, 2, "refcount"))
> +		return;
> +
> +	ret = bpf_map__update_elem(map, &key, sizeof(key), values, values_sz, flags);
> +	if (!ASSERT_OK(ret, "bpf_map__update_elem dec refcount"))
> +		return;
> +
> +	fd = bpf_program__fd(prog_check);
> +	ret = bpf_prog_test_run_opts(fd, opts);
> +	ASSERT_OK(ret, "bpf_prog_test_run_opts");
> +	ASSERT_EQ(skel->bss->kptr_refcount, 1, "refcount");
> +}
> +

[...]