linux-kernel - Re: [PATCH bpf-next v5 2/2] selftests/bpf: Add test to verify freeing the special fields when update [lru_,]percpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ca11cc02-0cf6-48aa-8840-1662fa61dbbc@linux.dev>
Date: Wed, 5 Nov 2025 22:09:49 +0800
From: Leon Hwang <leon.hwang@...ux.dev>
To: Alexei Starovoitov <alexei.starovoitov@...il.com>, bot+bpf-ci@...nel.org
Cc: bpf <bpf@...r.kernel.org>, Alexei Starovoitov <ast@...nel.org>,
 Andrii Nakryiko <andrii@...nel.org>, Daniel Borkmann <daniel@...earbox.net>,
 Martin KaFai Lau <martin.lau@...ux.dev>, Eduard <eddyz87@...il.com>,
 Song Liu <song@...nel.org>, Yonghong Song <yonghong.song@...ux.dev>,
 John Fastabend <john.fastabend@...il.com>, KP Singh <kpsingh@...nel.org>,
 Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>,
 Jiri Olsa <jolsa@...nel.org>, Kumar Kartikeya Dwivedi <memxor@...il.com>,
 Amery Hung <ameryhung@...il.com>, LKML <linux-kernel@...r.kernel.org>,
 kernel-patches-bot@...com, Martin KaFai Lau <martin.lau@...nel.org>,
 Chris Mason <clm@...a.com>, Ihor Solodrai <ihor.solodrai@...ux.dev>
Subject: Re: [PATCH bpf-next v5 2/2] selftests/bpf: Add test to verify freeing
 the special fields when update [lru_,]percpu_hash maps



On 2025/11/5 01:37, Alexei Starovoitov wrote:
> On Tue, Nov 4, 2025 at 6:52 AM <bot+bpf-ci@...nel.org> wrote:
>>
>>> diff --git a/tools/testing/selftests/bpf/progs/refcounted_kptr.c b/tools/testing/selftests/bpf/progs/refcounted_kptr.c
>>> index 893a4fdb4..87b0cc018 100644
>>> --- a/tools/testing/selftests/bpf/progs/refcounted_kptr.c
>>> +++ b/tools/testing/selftests/bpf/progs/refcounted_kptr.c
>>
>> [ ... ]
>>
>>> @@ -568,4 +568,64 @@ int BPF_PROG(rbtree_sleepable_rcu_no_explicit_rcu_lock,
>>>       return 0;
>>>  }
>>>
>>> +private(kptr_ref) u64 ref;
>>> +
>>> +static int probe_read_refcount(void)
>>> +{
>>> +     u32 refcount;
>>> +
>>> +     bpf_probe_read_kernel(&refcount, sizeof(refcount), (void *) ref);
>>> +     return refcount;
>>> +}
>>> +
>>> +static int __insert_in_list(struct bpf_list_head *head, struct bpf_spin_lock *lock,
>>> +                         struct node_data __kptr **node)
>>> +{
>>> +     struct node_data *n, *m;
>>> +
>>> +     n = bpf_obj_new(typeof(*n));
>>> +     if (!n)
>>> +             return -1;
>>> +
>>> +     m = bpf_refcount_acquire(n);
>>> +     n = bpf_kptr_xchg(node, n);
>>> +     if (n) {
>>> +             bpf_obj_drop(n);
>>> +             bpf_obj_drop(m);
>>> +             return -2;
>>> +     }
>>
>> In __insert_in_list(), after bpf_kptr_xchg() stores the new object in
>> the map and returns the old value in n, can the error path drop both
>> n and m? At this point, the new object (pointed to by m) is already
>> referenced by the map. Dropping m here would free an object that the
>> map still points to, leaving a dangling pointer.
> 
> AI is wrong, but I bet it got confused by reuse of variable 'n'.
> It's hard for humans too.
> Leon,
> please use a different var.
> n = bpf_kptr_xchg(node, n); is a head scratcher.

No problem.

I'll update the variable names in the next revision.

> 
> Also see Yonghong's comment on v4 which I suspect applies to v5.

That was actually a misunderstanding — he didn't run the newly added tests.

Still, I'll update the test name to include "refcounted_kptr" to make it
clearer and help avoid such confusion in the future.

Thanks,
Leon