tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

selftests/bpf: Add test for struct_ops __ref argument in any position

Add a selftest to verify that the verifier correctly identifies refcounted
arguments in struct_ops programs, even when they are not the first
argument. This ensures that the restriction on tail calls for programs
with __ref arguments is properly enforced regardless of which argument
they appear in.

This test verifies the fix for check_struct_ops_btf_id() proposed by
Keisuke Nishimura [0], which corrected a bug where only the first
argument was checked for the refcounted flag.
The test includes:
- An update to bpf_testmod to add 'test_refcounted_multi', an operator with
three arguments where the third is tagged with "__ref".
- A BPF program 'test_refcounted_multi' that attempts a tail call.
- A test runner that asserts the verifier rejects the program with
"program with __ref argument cannot tail call".

[0]: https://lore.kernel.org/bpf/20260320130219.63711-1-keisuke.nishimura@inria.fr/

Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>
Link: https://lore.kernel.org/r/20260321214038.80479-1-varunrmallya@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

authored by

Varun R Mallya and committed by
Alexei Starovoitov b43d574c 25e3e1f1

+54
+9
tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
··· 1 + // SPDX-License-Identifier: GPL-2.0 2 + 3 + #include <test_progs.h> 4 + #include "struct_ops_multi_args.skel.h" 5 + 6 + void test_struct_ops_multi_args(void) 7 + { 8 + RUN_TESTS(struct_ops_multi_args); 9 + }
+35
tools/testing/selftests/bpf/progs/struct_ops_multi_args.c
··· 1 + // SPDX-License-Identifier: GPL-2.0 2 + /* Copyright (c) 2026 Varun R Mallya */ 3 + 4 + #include <vmlinux.h> 5 + #include <bpf/bpf_helpers.h> 6 + #include <bpf/bpf_tracing.h> 7 + #include "../test_kmods/bpf_testmod.h" 8 + #include "bpf_misc.h" 9 + 10 + char _license[] SEC("license") = "GPL"; 11 + 12 + struct { 13 + __uint(type, BPF_MAP_TYPE_PROG_ARRAY); 14 + __uint(max_entries, 1); 15 + __uint(key_size, sizeof(__u32)); 16 + __uint(value_size, sizeof(__u32)); 17 + } prog_array SEC(".maps"); 18 + 19 + SEC("struct_ops/test_refcounted_multi") 20 + __failure __msg("program with __ref argument cannot tail call") 21 + int test_refcounted_multi(unsigned long long *ctx) 22 + { 23 + /* ctx[2] is used because the refcounted variable is the third argument */ 24 + struct task_struct *refcounted_task = (struct task_struct *)ctx[2]; 25 + 26 + bpf_task_release(refcounted_task); 27 + bpf_tail_call(ctx, &prog_array, 0); 28 + 29 + return 0; 30 + } 31 + 32 + SEC(".struct_ops.link") 33 + struct bpf_testmod_ops testmod_ref_acquire = { 34 + .test_refcounted_multi = (void *)test_refcounted_multi, 35 + };
+7
tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
··· 1411 1411 return 0; 1412 1412 } 1413 1413 1414 + static int bpf_testmod_ops__test_refcounted_multi(int dummy, struct task_struct *task__nullable, 1415 + struct task_struct *task__ref) 1416 + { 1417 + return 0; 1418 + } 1419 + 1414 1420 static struct task_struct * 1415 1421 bpf_testmod_ops__test_return_ref_kptr(int dummy, struct task_struct *task__ref, 1416 1422 struct cgroup *cgrp) ··· 1429 1423 .test_2 = bpf_testmod_test_2, 1430 1424 .test_maybe_null = bpf_testmod_ops__test_maybe_null, 1431 1425 .test_refcounted = bpf_testmod_ops__test_refcounted, 1426 + .test_refcounted_multi = bpf_testmod_ops__test_refcounted_multi, 1432 1427 .test_return_ref_kptr = bpf_testmod_ops__test_return_ref_kptr, 1433 1428 }; 1434 1429
+3
tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
··· 39 39 int (*unsupported_ops)(void); 40 40 /* Used to test ref_acquired arguments. */ 41 41 int (*test_refcounted)(int dummy, struct task_struct *task); 42 + /* Used to test checking of __ref arguments when it not the first argument. */ 43 + int (*test_refcounted_multi)(int dummy, struct task_struct *task, 44 + struct task_struct *task2); 42 45 /* Used to test returning referenced kptr. */ 43 46 struct task_struct *(*test_return_ref_kptr)(int dummy, struct task_struct *task, 44 47 struct cgroup *cgrp);