summaryrefslogtreecommitdiff
path: root/tools/testing/selftests/bpf
AgeCommit message (Collapse)Author
10 hoursMerge branch 'master' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
11 hoursMerge branch 'for-next' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
11 hoursMerge branch 'main' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git # Conflicts: # MAINTAINERS # tools/testing/selftests/net/lib.sh
14 hoursMerge branch 'vfs.all' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git # Conflicts: # fs/bpf_fs_kfuncs.c # tools/testing/selftests/filesystems/.gitignore # tools/testing/selftests/filesystems/Makefile
30 hoursselftests/bpf: Skip res_spin_lock_stress if no perf supportMaxim Khmelevskii
Probe PMU support before loading bpf_test_rqspinlock.ko, otherwise the test fails with not obvious error without proper perf event support: Failed to load bpf_test_rqspinlock.ko into the kernel: -2 serial_test_res_spin_lock_stress:FAIL:load module AA unexpected error: -22 (errno 2) Reported-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Maxim Khmelevskii <max@linux.ibm.com> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Link: https://lore.kernel.org/bpf/20260708104729.1248234-2-max@linux.ibm.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
31 hoursselftests/bpf: Close fd on unexpected success in signed loaderDaniel Borkmann
The signature_enforced, signature_too_large, signature_zero_size and signature_bad_keyring subtests load a program that must be rejected, but leave the fd open if the kernel unexpectedly accepts the load: test_progs asserts record the failure and continue, so the fd would linger for the rest of the run. Just close it. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260708184107.369182-1-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
31 hoursselftests/bpf: Verify load-time signed loader metadataDaniel Borkmann
The signed gen_loader no longer checks its metadata map from within BPF; the kernel does it at BPF_PROG_LOAD by folding the loader's frozen exclusive fd_array maps into the signature. Exercise that path end to end. Extend with more test cases (e.g. map-less program, asserting the LSM admission hook observes BPF_SIG_UNSIGNED and BPF_SIG_VERIFIED), and retire the subtests that asserted the old in-loader check, which no longer exists. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t signed_loader [...] #412/1 signed_loader/loadtime_no_map:OK #412/2 signed_loader/loadtime_with_map:OK #412/3 signed_loader/metadata_match:OK #412/4 signed_loader/signature_enforced:OK #412/5 signed_loader/signed_nonexcl_fd_array_rejected:OK #412/6 signed_loader/signed_unfrozen_fd_array_rejected:OK #412/7 signed_loader/signed_nonarray_fd_array_rejected:OK #412/8 signed_loader/signed_btf_fd_array_rejected:OK #412/9 signed_loader/signed_module_kfunc_rejected:OK #412/10 signed_loader/signature_failure_logs:OK #412/11 signed_loader/signature_too_large:OK #412/12 signed_loader/signature_zero_size:OK #412/13 signed_loader/signature_bad_keyring:OK #412/14 signed_loader/metadata_ctx_max_entries_ignored:OK #412/15 signed_loader/metadata_ctx_initial_value_ignored:OK #412/16 signed_loader/signature_authenticates_insns:OK #412/17 signed_loader/signature_authenticates_metadata:OK #412/18 signed_loader/hash_requires_frozen:OK #412/19 signed_loader/no_update_after_freeze:OK #412/20 signed_loader/freeze_writable_mmap:OK #412/21 signed_loader/no_writable_mmap_frozen:OK #412/22 signed_loader/map_hash_matches_libbpf:OK #412/23 signed_loader/map_hash_multi_element:OK #412/24 signed_loader/map_hash_bad_size:OK #412/25 signed_loader/map_hash_unsupported_type:OK #412/26 signed_loader/lsm_signature_verdict:OK #412/27 signed_loader/signed_no_fd_array:OK #412/28 signed_loader/signed_map_by_fd_rejected:OK #412/29 signed_loader/signed_sparse_fd_array_rejected:OK #412 signed_loader:OK Summary: 1/29 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260708075343.358712-8-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
31 hoursselftests/bpf: Adjust bpf_map layout in verifier_map_ptrDaniel Borkmann
With write-only excl member removed from struct bpf_map, ops moves to offset 32 and inner_map_meta to offset 40. Update the expected verifier message for the former and retarget the latter at the sha byte array, so the beyond-member-end rejection path stays covered: # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_map_ptr [...] #619/5 verifier_map_ptr/bpf_map_ptr: read non-existent field rejected:OK #619/6 verifier_map_ptr/bpf_map_ptr: read non-existent field rejected @unpriv:OK #619/7 verifier_map_ptr/bpf_map_ptr: read beyond sha field rejected:OK #619/8 verifier_map_ptr/bpf_map_ptr: read beyond sha field rejected @unpriv:OK #619/9 verifier_map_ptr/bpf_map_ptr: read ops field accepted:OK #619/10 verifier_map_ptr/bpf_map_ptr: read ops field accepted @unpriv:OK [...] #620 verifier_map_ptr_mixing:OK Summary: 2/20 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260708075343.358712-7-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
41 hoursMerge branch 'perf/core' into perf/merge, to ease CI testingIngo Molnar
Signed-off-by: Ingo Molnar <mingo@kernel.org>
42 hoursselftests/bpf: Add untrusted BTF write regressionKumar Kartikeya Dwivedi
Add a TCP congestion-control struct_ops load test for a write through a BTF pointer produced by bpf_rdonly_cast(). The test expects the verifier to reject the program before the TCP CA btf_struct_access callback can whitelist the tcp_sock field write. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Reviewed-by: Amery Hung <ameryhung@gmail.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
46 hoursselftests/bpf: Rename libarena struct bitmap to struct arena_bitmapYonghong Song
When building bpf selftest with latest bpf-next, I got the following failure: In file included from /home/yhs/work/bpf-next/tools/testing/selftests/bpf/libarena/selftests/test_parallel_bitmap.bpf.c:8: /home/yhs/work/bpf-next/tools/testing/selftests/bpf/libarena/include/libarena/bitmap.h:11:8: error: redefinition of 'bitmap' 11 | struct bitmap { | ^ /home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/include/vmlinux.h:51320:8: note: previous definition is here 51320 | struct bitmap { | ^ The vmlinux.h struct bitmap comes from drivers/md/md-bitmap.c: struct bitmap { struct bitmap_counts { ... } ... } To fix the issue, I renamed libarena struct bitmap to arena_bitmap to avoid the conflict. Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260707220136.910374-1-yonghong.song@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
48 hoursselftests/bpf: Test cases for missing spill typesEduard Zingerman
A few selftests checking that the verifier represents spills for the following pointer types w/o losing precision: - PTR_TO_INSN - PTR_TO_TP_BUFFER - CONST_PTR_TO_DYNPTR Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260707-missing-spillable-types-v1-2-44a92121dc41@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2 daysselftests/bpf: Fix memory leak in msg_alloc_iovFeng Yang
In the msg_alloc_iov function, the iov pointer is only assigned to msg->msg_iov after all memory allocations complete successfully. Therefore, when a calloc failure triggers the unwind_iov cleanup branch, we should use the local variable iov instead of msg->msg_iov. Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap") Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Reviewed-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20260707081434.539327-1-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2 daysselftests/bpf: Drop tc/xdp/flow_dissector/socket_filter sockmap mutation testsSechang Lim
tc, xdp, socket_filter and flow_dissector programs can no longer update or delete a sockmap. Adjust the tests: - verifier_sockmap_mutate: the tc, xdp, socket_filter and flow_dissector cases now expect __failure with "cannot update sockmap in this context". - sockmap_basic: drop "sockmap update" / "sockhash update", which load a SEC("tc") program that copies a sock between maps. - fexit_bpf2bpf: drop "func_sockmap_update", whose freplace program updates a sockmap in the tc cls_redirect context. Remove the now-unused test_sockmap_update.c and freplace_cls_redirect.c. Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: John Fastabend <john.fastabend@gmail.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260630145410.3648099-3-rhkrqnwk98@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2 daysselftests/bpf: Add test for bpf_get_smp_processor_idMaxim Khmelevskii
Add a test which checks on each CPU that the bpf_get_smp_processor_id BPF helper is returning the correct CPU number. Signed-off-by: Maxim Khmelevskii <max@linux.ibm.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Link: https://lore.kernel.org/bpf/20260703125648.919196-6-max@linux.ibm.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2 daysselftests/bpf: Cover MEM_ALLOC access past object boundsYiyang Chen
Add a linked_list negative loader case for a program-BTF type whose last member is a zero-length flexible array. The program writes through the first flexible-array element of an object allocated by bpf_obj_new(). The verifier should reject the access when the BTF walk reaches beyond the static size of the allocated object. Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/e36fd5d2f4047809f0e5da46a7077083297e64db.1782807039.git.chenyy23@mails.tsinghua.edu.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2 daysselftests/bpf: Fix memory leak in msg_alloc_iov error pathMalaya Kumar Rout
In msg_alloc_iov(), when calloc() fails for an individual iov_base allocation, the error path frees all previously allocated iov_base entries but fails to free the iov array itself that was allocated with calloc() at the beginning of the function. This results in a memory leak of the iov array. Add free(iov) in the unwind_iov error path to ensure proper cleanup of all allocated memory. Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap") Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260704122936.102394-1-malayarout91@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2 daysselftests/bpf: libarena: Add parallel bitmap selftestEmil Tsalapatis
Add a selftest for testing the atomic bitmap set/clear/ test_and_set/test_and_clear operations. The selftest checks atomicity by spawning two threads, each of which either only works on even bits or with odd bits. The test checks that threads do not affect each other's bits. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260706181730.21731-7-emil@etsalapatis.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2 daysselftests/bpf: libarena: Add bitmap selftestsEmil Tsalapatis
Add testing for the new arena bitmap data structure. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/bpf/20260706181730.21731-6-emil@etsalapatis.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2 daysselftests/bpf: Add arena-based bitmap data structureEmil Tsalapatis
Add an arena-based word-aligned bitmap data struture. The structure is useful as a building block, e.g., sched-ext uses it to represent cpumask structures. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260706181730.21731-5-emil@etsalapatis.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2 daysselftests/bpf: libarena: Clean up allocation state before buddy testsEmil Tsalapatis
Summary: The buddy allocator requires the global BPF buddy allocator to not be already initialized. However, the test currently merely resets the allocator before the buddy tests instead of destroying it, and the test worked because the buddy test happened to run first. Properly destroy the allocator instead of resetting it. Fixes: b1487dc1b181 ("selftests/bpf: Add selftests for libarena buddy allocator") Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/bpf/20260706181730.21731-4-emil@etsalapatis.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2 daysselftests/bpf: libarena: Fix can-loop zero variable definitionEmil Tsalapatis
BPF can_loop based loops require the index variable to stay imprecise. This means we must initialize them from a currently imprecise variable instead of directly assigning 0 to them, like so: static volatile u32 zero = 0; for (i = zero; i < NUM_LOOPS; i++) { /* loop body */ } The libarena implementation of this technique is currently faulty. For the technique to work, the variable must not be in a map. This includes the .rodata DATASEC map used for const variables. However, libarena still defines the zero variable as constant. Modify the zero variable definition into a volatile variable. This change adds a complication caused by the compiler optimizing array derefences from for (i = zero; i < NUM_LOOPS; i++) { val = *(ptr + i); } into for (i = zero; i < NUM_LOOPS; i++) { val = *ptr++; } and causing verification failures. Use the barrier_var() clobber macro to prevent this optimization from taking place. Using barrier_var() is the only way to break the optimization, as annotating the index as volatile does not suffice. After that, remove the bpf_for() invocations introduced in libarena for parallel spmc testing. Reported-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260706181730.21731-3-emil@etsalapatis.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2 daysselftests/bpf: libarena: Replace leftover st_ prefix with test_Emil Tsalapatis
The st_ (selftests_) prefix is confusing and has been replaced with the more descriptive test_. However, last patch did not properly move all files to the new prefix. Rename the existing files to complete the move. Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260706181730.21731-2-emil@etsalapatis.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
6 daysselftests/bpf: Add tests for forked/cloned optimized uprobesJiri Olsa
Adding tests for forked/cloned optimized uprobes and make sure the child can properly execute optimized probe for both fork (dups mm) and clone with CLONE_VM. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://patch.msgid.link/20260703114917.238144-14-jolsa@kernel.org
6 daysselftests/bpf: Add tests for uprobe nop10 red zone clobberingAndrii Nakryiko
The uprobe nop5 optimization used to replace a 5-byte NOP with a 5-byte CALL to a trampoline. The CALL pushes a return address onto the stack at [rsp-8], clobbering whatever was stored there. On x86-64, the red zone is the 128 bytes below rsp that user code may use for temporary storage without adjusting rsp. Compilers can place USDT argument operands there, generating specs like "8@-8(%rbp)" when rbp == rsp. With the CALL-based optimization, the return address overwrites that argument before the BPF-side USDT argument fetch runs. Add two tests for this case. The uprobe_syscall subtest stores known values at -8(%rsp), -16(%rsp), and -24(%rsp), executes an optimized nop10 uprobe, and verifies the red-zone data is still intact. The USDT subtest triggers a probe in a function where the compiler places three USDT operands in the red zone and verifies that all 10 optimized invocations deliver the expected argument values to BPF. On an unfixed kernel, the first hit goes through the INT3 path and later hits use the optimized CALL path, so the red-zone checks fail after optimization. [ updates to use nop10 ] Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://patch.msgid.link/20260703114917.238144-13-jolsa@kernel.org
6 daysselftests/bpf: Add reattach tests for uprobe syscallJiri Olsa
Adding reattach tests for uprobe syscall tests to make sure we can re-attach and optimize same uprobe multiple times. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://patch.msgid.link/20260703114917.238144-12-jolsa@kernel.org
6 daysselftests/bpf: Change uprobe/usdt trigger bench code to use nop10Jiri Olsa
Changing uprobe/usdt trigger bench code to use nop10 instead of nop5. Also changing run_bench_uprobes.sh to use nop10 triggers. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://patch.msgid.link/20260703114917.238144-11-jolsa@kernel.org
6 daysselftests/bpf: Change uprobe syscall tests to use nop10Jiri Olsa
Optimized uprobes are now on top of 10-bytes nop instructions, reflect that in existing tests. Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://patch.msgid.link/20260703114917.238144-10-jolsa@kernel.org
6 daysselftests/bpf: Emit nop,nop10 instructions combo for x86_64 archJiri Olsa
Syncing latest usdt.h change [1]. Now that we have nop10 optimization support in kernel, let's emit nop,nop10 for usdt probe. We leave it up to the library to use desirable nop instruction. [1] https://github.com/libbpf/usdt/commit/9018f82577d1dad7ed628d9efdaffc09f8f2241b Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://patch.msgid.link/20260703114917.238144-9-jolsa@kernel.org
6 dayslibbpf: Detect uprobe syscall with new errorJiri Olsa
In the previous optimized uprobe fix we changed the syscall error used for its detection from ENXIO to EPROTO. Changing related probe_uprobe_syscall detection check. Fixes: 05738da0efa1 ("libbpf: Add uprobe syscall feature detection") Fixes: 554ba38456da ("uprobes/x86: Move optimized uprobe from nop5 to nop10") Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Ingo Molnar <mingo@kernel.org> Acked-by: Andrii Nakryiko <andrii@kernel.org> Link: https://patch.msgid.link/20260703114917.238144-8-jolsa@kernel.org
6 daysMerge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc2Daniel Borkmann
Cross-merge BPF and other fixes after downstream PR. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
7 daysMerge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netPaolo Abeni
Cross-merge networking fixes after downstream PR (net-7.2-rc2). No conflicts. Adjacent changes: MAINTAINERS: 56114690ff3c ("MAINTAINERS: Update Marvell octeontx2 driver maintainers") eb56577ae9a5 ("ehea: remove the ehea driver") net/core/netpoll.c: 45f1458a8501 ("netpoll: fix a use-after-free on shutdown path") 84c0ff1efb62 ("netpoll: do not warn when the best-effort pool refill fails") Signed-off-by: Paolo Abeni <pabeni@redhat.com>
7 daysMerge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull BPF fixes from Daniel Borkmann: - Initialize task local storage before fork bails out to free the task (Jann Horn) - Fix insn_aux_data leak on verifier error path (KaFai Wan) - Reject BPF inode storage map creation when BPF LSM is uninitialized (Matt Bobrowski) - Mask pseudo pointer values in verifier logs when pointer leaks are not allowed (Nuoqi Gui) - Harden BPF JIT against spraying via IBPB flush (Pawan Gupta) - Reject a skb-modifying SK_SKB stream parser since the latter is only meant to measure the next message (Sechang Lim) - Fix bpf_refcount_acquire to reject refcounted allocation arguments with a non-zero fixed offset (Yiyang Chen) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Prefer dirty packs for eBPF allocations bpf: Prefer packs that won't trigger an IBPB flush on allocation bpf: Skip redundant IBPB in pack allocator bpf: Restrict JIT predictor flush to cBPF x86/bugs: Enable IBPB flush on BPF JIT allocation bpf: Support for hardening against JIT spraying bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized bpf,fork: wipe ->bpf_storage before bailouts that access it bpf: Fix insn_aux_data leak on verifier err_free_env path selftests/bpf: Cover pseudo-BTF ksym log masking bpf: Mask pseudo pointer values in verifier logs selftests/bpf: Cover refcount acquire node offsets bpf: Reject offset refcount acquire arguments selftests/bpf: test rejection of a packet-modifying SK_SKB stream parser bpf, sockmap: reject a packet-modifying SK_SKB stream parser selftests/bpf: don't modify the skb in the strparser parser prog
8 daysselftests/bpf: Fix test_maps sockmap failureJiayuan Chen
test_maps fails in the sockmap test because sockmap_verdict_prog.c drops the packet when the first 8 bytes are not directly accessible: if (data + 8 > data_end) return SK_DROP; The blamed commit removed bpf_skb_pull_data() from the stream parser program so that the parser no longer modifies the skb. That was needed, but it also removed an implicit side effect: bpf_skb_pull_data() linearized enough of the skb for later direct packet access. In this test, the send side goes through the sockmap SK_MSG path. The skb can have skb->len == 20 while its linear area is empty, so the verdict program sees data == data_end and drops the packet even though the payload length is sufficient. Keep the parser read-only, and pull the first 8 bytes in the verdict program before reading or writing them. Reload data/data_end after bpf_skb_pull_data() as required. Fixes: 22a0cc10dacb ("selftests/bpf: don't modify the skb in the strparser parser prog") Reported-by: Ihor Solodrai <ihor.solodrai@linux.dev> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260701071501.39628-1-jiayuan.chen@linux.dev Closes: https://lore.kernel.org/bpf/e3a91acd-2b4d-4e93-a3bb-a0e9ee5ede0f@linux.dev/
8 daysselftests/bpf: Mask socket type flags in mptcpify progGuillaume Maudoux
The mptcpify BPF prog upgrades eligible TCP sockets to MPTCP, but only when the socket type is exactly SOCK_STREAM. Its update_socket_protocol() hook runs on the raw type from userspace, before the socket core masks it with SOCK_TYPE_MASK, so the type may still carry SOCK_CLOEXEC or SOCK_NONBLOCK in its upper bits and the equality check fails. As a result, a socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0) -- what common libraries do by default -- is silently left as plain TCP. This was hit in practice with curl. Since mptcpify.c is referenced as example code for enabling MPTCP transparently, the same mistake is likely to be copied into real deployments where it fails the same way and is hard to diagnose. Mask the type before comparing, mirroring the socket core. Extend the test to also create the server with SOCK_CLOEXEC set; the same masking is applied to start_server_addr() so a flagged type still listens. Fixes: ddba122428a7 ("selftests/bpf: Add mptcpify test") Signed-off-by: Guillaume Maudoux <layus.on@gmail.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://lore.kernel.org/bpf/20260630095723.564392-1-layus.on@gmail.com
8 daysselftests/bpf: Add tracing_multi link info testsJiri Olsa
Adding tracing_multi link info tests that follow the kprobe_multi and uprobe_multi tests logic. Assisted-by: Codex:GPT-5 Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260629212208.895962-3-jolsa@kernel.org
8 daysselftests/bpf: Verify no non-zeroed kernel heap memory exposureLeon Hwang
When lookup element from those per-CPU maps, which have special field in their values and their value size is not equal to roundup(value_sz, 8), the padding size of temporary non-zeroed kernel heap memory allocated by kvmalloc should not be exposed to user space. Without the fix: test_map_uninit_mem_exposure:FAIL:zeroed tail bytes unexpected memory mismatch actual: 2B 2B 2B 2B expected: 00 00 00 00 Assisted-by: Codex:gpt-5.5 Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260624155115.85196-3-leon.hwang@linux.dev
9 daysselftests/xsk: Preserve UMEM view in BIDIRECTIONAL testMaciej Fijalkowski
The UMEM state refactor made __send_pkts() use xsk->umem for Tx address generation. At the same time, the shared-UMEM Tx setup copies the Rx UMEM state into a Tx-local state object and resets base_addr and next_buffer before configuring the Tx socket. Passing that Tx-local object to xsk_configure() makes xsk->umem point to the zero-based Tx allocator state. This breaks the BIDIRECTIONAL test once the roles are switched: the same socket is then used for Rx validation, but received descriptors from the other logical UMEM half are checked against base_addr == 0. With the new UMEM bounds check, a valid address such as base_addr + XDP_PACKET_HEADROOM is rejected as being outside the UMEM window. Keep xsk->umem as the shared/Rx UMEM view used for socket configuration and Rx validation. Use the ifobject-local UMEM copy only for Tx descriptor address generation, preserving the BIDIRECTIONAL test's intent of using the proper logical UMEM half after the direction switch. Reviewed-by: Jason Xing <kerneljasonxing@gmail.com> Reviewed-by: Tushar Vyavahare <tushar.vyavahare@intel.com> Tested-by: Tushar Vyavahare <tushar.vyavahare@intel.com> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Link: https://patch.msgid.link/20260629191221.2700-1-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
11 daysselftests/bpf: Add test for bpf_sock_read_xattr() kfuncChristian Brauner
Add a selftest that loads the kfunc in sleepable and non-sleepable lsm/socket_connect programs and checks that a value set via fsetxattr() on a socket is read back. Link: https://patch.msgid.link/20260617-work-bpf-sock-xattr-v1-2-a1276f7c9da3@kernel.org Reviewed-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
13 daysMerge tag 'loongarch-7.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Add THREAD_INFO_IN_TASK implementation - Add build salt to the vDSO - Add some BPF JIT inline helpers - Update DTS for I2C clocks and clock-frequency - Some bug fixes and other small changes * tag 'loongarch-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: selftests/bpf: Test jited inline of bpf_get_smp_processor_id() for LoongArch selftests/bpf: Test jited inline of bpf_get_current_task() for LoongArch selftests/bpf: Add __arch_loongarch to limit test cases for LoongArch selftests/bpf: Add get_preempt_count() support for LoongArch LoongArch: dts: Add i2c clocks and clock-frequency properties to LS2K2000 LoongArch: dts: Add i2c clocks and clock-frequency properties to LS2K1000 LoongArch: dts: Add i2c clocks and clock-frequency properties to LS2K0500 LoongArch: BPF: Inline bpf_get_smp_processor_id() helper LoongArch: BPF: Inline bpf_get_current_task/_btf() helpers LoongArch: BPF: Fix off-by-one error in tail call LoongArch: BPF: Fix outdated tail call comments LoongArch: Add build salt to the vDSO LoongArch: Fix nr passing in set_direct_map_valid_noflush() LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() LoongArch: Move struct kimage forward declaration before use LoongArch: Report dying CPU to RCU in stop_this_cpu() LoongArch: Add PIO for early access before ACPI PCI root register LoongArch: Add THREAD_INFO_IN_TASK implementation
2026-06-25selftests/bpf: Add kfunc set test to resolve_btfidsIhor Solodrai
Extend the resolve_btfids selftest to cover kfunc sets defined with BTF_KFUNCS_START/BTF_KFUNCS_END. The test verifies that resolve_btfids correctly processes BTF_ID_FLAGS, resolves function IDs, and checks the kfunc set is sorted. Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260624005546.1818483-5-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-25selftests/bpf: Fix resolve_btfids test reads of BTF ID sets in PIE buildsIhor Solodrai
TL;DR On aarch64 with gcc toolchain, when test_progs is linked as a PIE, reads of BTF ID array by C name return garbage because the GNU assembler on aarch64 unconditionally folds .local symbol references into section+addend form, and GOT slots cannot carry an addend per the AArch64 ELF spec. Fix by marking the test's BTF ID objects with hidden visibility, which makes gcc emit a direct access that bypasses the GOT entirely. Details below. The subsequent patches adding kfunc checks to resolve_btfids test may cause test failures on aarch64 / gcc-15: test_resolve_btfids:FAIL:kfunc_set_flags actual 13 != expected 1 test_resolve_btfids:FAIL:kfunc_set_cnt actual 0 != expected 4 The test defines its BTF ID sets with the same macros as the kernel and reads them back directly by C name (in the same way as the kernel code does). test_kfunc_set is a .local symbol emitted into .BTF_ids by inline asm and declared to the compiler as a plain default-visibility extern, that is: extern struct btf_id_set8 test_kfunc_set; Depending on the build environment, test_progs may be linked as a position-independent executable (for example, gcc defaults to -fpie [1]). In a PIE, taking the address of a default-visibility extern is routed through the GOT (Global Offset Table) [2]. The GNU assembler's adjust_reloc_syms() pass (gas/write.c [3]) replaces references to local symbols with the corresponding section symbol, folding the symbol's offset into the relocation addend. On aarch64 this conversion is unconditional: tc_fix_adjustable() is defined to 1 for all fixups (gas/config/tc-aarch64.h [4]), so even GOT-generating relocations are subject to it. The resulting object file therefore contains: R_AARCH64_ADR_GOT_PAGE .BTF_ids + 0x54 R_AARCH64_LD64_GOT_LO12_NC .BTF_ids + 0x54 However, the AArch64 ELF specification mandates that GOT-generating relocations must have a zero addend [5]. The +0x54 is therefore not honored: the linker creates a GOT slot pointing at the .BTF_ids base, and every access through that slot reads offset 0 instead of 0x54. This is purely a read-side problem, specific to the PIE test binary on aarch64 with gcc toolchain. resolve_btfids patches the set header correctly and the .BTF_ids bytes in test_progs are correct. vmlinux is unaffected because it is built with -fno-PIE [6] and reaches .BTF_ids with direct, addend-preserving relocations rather than the GOT. clang is unaffected because LLVM's assembler retains the original symbol for GOT relocations instead of converting to section+addend [7]. To mitigate this issue, mark the test's .local BTF ID objects (test_list_local and test_set) hidden with a visibility pragma so that gcc treats them as non-interposable and emits a direct access instead of a GOT load. test_list_global is .globl, which the assembler does not fold into section+addend, so it is left at default visibility. This keeps the natural by-name access, works in both PIE and non-PIE builds, and needs no change to the BTF_ID macros or resolve_btfids. [1] https://gcc.gnu.org/onlinedocs/gnat_ugn/Position-Independent-Executable-PIE-Enabled-by-Default-on-Linux.html [2] https://gcc.gnu.org/wiki/Visibility [3] https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=gas/write.c#l922 [4] https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=gas/config/tc-aarch64.h#l279 [5] https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst#5733relocation-operations [6] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Makefile?h=v7.1-rc6#n593 [7] https://github.com/llvm/llvm-project/blob/4b3bc46d1d794b8ed78b75ccd35a6cc30235bf31/llvm/lib/MC/ELFObjectWriter.cpp#L1213-L1224 Acked-by: Andrii Nakryiko <andrii@kernel.org> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/r/20260624005546.1818483-4-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-25selftests/bpf: Modernize resolve_btfids test scaffoldingIhor Solodrai
Refactor resolve_btfids test in order to: * use newer ASSERT_* macros instead of CHECK * extend the lifetime of loaded BTF to enable additional checks * cleanup unused/unnecessary code Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Acked-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/r/20260624005546.1818483-3-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-25selftests/bpf: Cover pseudo-BTF ksym log maskingNuoqi Gui
Add verifier_unpriv coverage for a raw socket-filter load of the bpf_prog_active typed ksym. The test verifies that the unprivileged load remains accepted and that the verbose verifier log prints the ldimm64 immediate as 0x0 instead of exposing a nonzero kernel address. Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn> Link: https://lore.kernel.org/r/20260623-f01-13-pseudo-btf-id-cap-bpf-v2-2-a190ebb8f3e2@mails.tsinghua.edu.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Eduard Zingerman <eddyz87@gmail.com>
2026-06-25selftests/bpf: Cover stack reads from zero spillsWoojin Ji
Add verifier_var_off coverage for variable-offset stack reads from spilled scalar constant zero values. Cover single-slot and cross-slot spilled zero reads, a sub-8-byte spill with neighbouring STACK_ZERO bytes, and a sub-8-byte spill with neighbouring STACK_MISC bytes that must not be treated as zero. Add verifier_spill_fill coverage for a fixed-offset stack read spanning both STACK_ZERO bytes and scalar const-zero STACK_SPILL bytes. Use verifier log assertions to check both the zero result and the precision backtracking trail. Assisted-by: opencode:gpt-5.5 Signed-off-by: Woojin Ji <random6.xyz@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260625-bpf-stack-var-off-zero-v1-v3-2-a068210a761b@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-25selftests/bpf: Cover refcount acquire node offsetsYiyang Chen
Add regression coverage for bpf_refcount_acquire() on graph-node-derived pointers. The rejected case passes a popped list node pointer directly to bpf_refcount_acquire(), which must fail because the pointer carries a non-zero fixed offset. Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/bf2a2033ced272106292de4465b8ef3fb991c912.1782192383.git.chenyy23@mails.tsinghua.edu.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-25selftests/bpf: test rejection of a packet-modifying SK_SKB stream parserSechang Lim
Verify that attaching an SK_SKB stream parser that can modify the packet is rejected, while a read-only parser still attaches. Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev> Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com> Link: https://lore.kernel.org/r/20260620024423.4141004-4-rhkrqnwk98@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-25selftests/bpf: don't modify the skb in the strparser parser progSechang Lim
sockmap_parse_prog.c is attached as an SK_SKB stream parser and modifies the skb: it calls bpf_skb_pull_data() and writes a byte into the packet. A stream parser runs on strparser's message head and must not modify it. A resize frees the frag_list segments strparser still tracks, leading to a use-after-free. Make the parser read-only. It only needs to return the message length, which keeps it attaching once packet-modifying parsers are rejected. Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev> Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com> Link: https://lore.kernel.org/r/20260620024423.4141004-2-rhkrqnwk98@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-25selftests/bpf: Add tests for bpf_redirect_peer with BPF_F_EGRESSJordan Rife
Extend redirect tests to cover bpf_redirect_peer(BPF_F_EGRESS). SRC redirects to DST using bpf_redirect_peer(BPF_F_EGRESS) then traffic is hairpinned into DST using bpf_redirect. Signed-off-by: Jordan Rife <jordan@jrife.io> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Paul Chaignon <paul.chaignon@gmail.com> Link: https://lore.kernel.org/r/20260618182035.43811-3-jordan@jrife.io Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-06-25Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull bpf fixes from Alexei Starovoitov: - Fix effective prog array index with BPF_F_PREORDER (Amery Hung) - Zero-initialize the fib lookup flow struct (Avinash Duduskar) - Disable xfrm_decode_session hook attachment (Bradley Morgan) - Allow type tag BTF records to succeed other modifier records (Emil Tsalapatis) - Fix build_id caching in stack_map_get_build_id_offset() (Ihor Solodrai) - Add missing access_ok call to copy_user_syms (Jiri Olsa) - Fix stack slot index in nospec checks (Nuoqi Gui) - Preserve pointer spill metadata during half-slot cleanup (Nuoqi Gui) - Fix partial copy of non-linear test_run output (Sun Jian) - Fix BPF_PROG_ASSOC_STRUCT_OPS last field check (Thiébaud Weksteen) - Reset register bounds before narrowing retval range (Tristan Madani) - Fix vmlinux BTF leak in bpftool cgroup commands (Yichong Chen) - Guard error writes in conntrack kfuncs (Yiyang Chen) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Disable xfrm_decode_session hook attachment selftests/bpf: Add test for stale bounds on LSM retval context load bpf: Reset register bounds before narrowing retval range in check_mem_access() selftests/bpf: Cover small conntrack opts error writes bpf: Guard conntrack opts error writes selftests/bpf: Cover half-slot cleanup of pointer spills bpf: Preserve pointer spill metadata during half-slot cleanup selftests/bpf: Test cgroup link replace with BPF_F_PREORDER bpf: Fix effective prog array index with BPF_F_PREORDER bpf: Fix BPF_PROG_ASSOC_STRUCT_OPS last field check bpf: zero-initialize the fib lookup flow struct bpftool: Fix vmlinux BTF leak in cgroup commands bpf: Add missing access_ok call to copy_user_syms bpf: Allow type tag BTF records to succeed other modifier records bpf: Emit verbose message when prog-specific btf_struct_access rejects a write bpf: Fix build_id caching in stack_map_get_build_id_offset() bpf: Fix partial copy of non-linear test_run output selftests/bpf: Cover stack nospec slot indexing bpf: Fix stack slot index in nospec checks