| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <697dc64e-8707-44ba-8cda-ba48747f2973@linux.dev> Date: Wed, 5 Nov 2025 10:14:40 +0800 From: Leon Hwang <leon.hwang@...ux.dev> To: Yonghong Song <yonghong.song@...ux.dev>, bpf@...r.kernel.org Cc: ast@...nel.org, andrii@...nel.org, daniel@...earbox.net, martin.lau@...ux.dev, eddyz87@...il.com, song@...nel.org, john.fastabend@...il.com, kpsingh@...nel.org, sdf@...ichev.me, haoluo@...gle.com, jolsa@...nel.org, memxor@...il.com, ameryhung@...il.com, linux-kernel@...r.kernel.org, kernel-patches-bot@...com Subject: Re: [PATCH bpf-next v4 4/4] selftests/bpf: Add tests to verify freeing the special fields when update hash and local storage maps On 5/11/25 01:30, Yonghong Song wrote: > > > On 10/30/25 8:24 AM, Leon Hwang wrote: >> Add tests to verify that updating hash and local storage maps decrements >> refcount when BPF_KPTR_REF objects are involved. >> >> The tests perform the following steps: >> >> 1. Call update_elem() to insert an initial value. >> 2. Use bpf_refcount_acquire() to increment the refcount. >> 3. Store the node pointer in the map value. >> 4. Add the node to a linked list. >> 5. Probe-read the refcount and verify it is *2*. >> 6. Call update_elem() again to trigger refcount decrement. >> 7. Probe-read the refcount and verify it is *1*. >> >> Signed-off-by: Leon Hwang <leon.hwang@...ux.dev> > > I applied this patch only (i.e., not including patches 1/2/3) to master > branch and do bpf selftest and all tests succeeded. > > [root@...h-fb-vm1 bpf]# ./test_progs -t refcounted_kptr > #294/1 refcounted_kptr/insert_read_both: remove from tree + list:OK > ... > #294/18 refcounted_kptr/pcpu_hash_refcount_leak:OK > #294/19 refcounted_kptr/check_pcpu_hash_refcount:OK > #294/20 refcounted_kptr/hash_lock_refcount_leak:OK > #294/21 refcounted_kptr/check_hash_lock_refcount:OK > #294/22 refcounted_kptr/rbtree_sleepable_rcu:OK > #294/23 refcounted_kptr/rbtree_sleepable_rcu_no_explicit_rcu_lock:OK > #294/24 refcounted_kptr/cgroup_storage_lock_refcount_leak:OK > #294/25 refcounted_kptr/check_cgroup_storage_lock_refcount:OK > ... > > Did I miss anything? > Oops. You should run: ./test_progs -t kptr_refcount The results are as follows: test_percpu_hash_refcount_leak:PASS:libbpf_num_possible_cpus 0 nsec test_percpu_hash_refcount_leak:PASS:calloc values 0 nsec test_percpu_hash_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:PASS:refcount 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 #158/1 kptr_refcount_leak/percpu_hash_refcount_leak:FAIL test_hash_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:PASS:refcount 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 #158/2 kptr_refcount_leak/hash_lock_refcount_leak:FAIL test_cgroup_storage_lock_refcount_leak:PASS:setup_cgroup_environment 0 nsec test_cgroup_storage_lock_refcount_leak:PASS:get_root_cgroup 0 nsec test_cgroup_storage_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:PASS:refcount 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 #158/3 kptr_refcount_leak/cgroup_storage_lock_refcount_leak:FAIL #158 kptr_refcount_leak:FAIL All error logs: test_percpu_hash_refcount_leak:PASS:libbpf_num_possible_cpus 0 nsec test_percpu_hash_refcount_leak:PASS:calloc values 0 nsec test_percpu_hash_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:PASS:refcount 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 #158/1 kptr_refcount_leak/percpu_hash_refcount_leak:FAIL test_hash_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:PASS:refcount 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 #158/2 kptr_refcount_leak/hash_lock_refcount_leak:FAIL test_cgroup_storage_lock_refcount_leak:PASS:setup_cgroup_environment 0 nsec test_cgroup_storage_lock_refcount_leak:PASS:get_root_cgroup 0 nsec test_cgroup_storage_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:PASS:refcount 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 #158/3 kptr_refcount_leak/cgroup_storage_lock_refcount_leak:FAIL #158 kptr_refcount_leak:FAIL Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED All three tests failed because the refcount remained 2 instead of decreasing to 1 after the second update_elem() call. The CI result [1] also demonstrates this issue. Sorry for the misleading test name earlier. Links: [1] https://github.com/kernel-patches/bpf/pull/10203 Thanks, Leon [...]
Powered by blists - more mailing lists