summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
2026-09-06selftests/bpf: Enable stack argument tests for RV64Feng Jiang
Enable the stack argument selftests for RV64. The riscv guard is restricted to __riscv_xlen == 64 since stack arguments are only supported by the RV64 JIT. Keep the __BPF_FEATURE_STACK_ARGUMENT gate, defined by clang with BPF stack argument support [1]. [1] https://github.com/llvm/llvm-project/pull/189060 Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20260905085857.14143-4-pulehui@huaweicloud.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-09-06riscv, bpf: Remap BPF_REG_0 and RV_REG_TCCPu Lehui
To prepare for supporting bpf stack arguments and unifying the calling convention between bpf2bpf calls and kfunc calls, remap BPF_REG_0 to t6 and RV_REG_TCC to t5. In the riscv abi, a0-a7 are designated for function argument passing. Freeing a5 and a6 allows bpf2bpf calls to pass extra arguments (6th to 8th) via a5-a7 consistently with kfuncs. Signed-off-by: Pu Lehui <pulehui@huawei.com> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20260905085857.14143-2-pulehui@huaweicloud.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-09-05selftests/bpf: Test pointer bpf_loop iteration count rejectionKumar Kartikeya Dwivedi
Add a verifier test that leaves the raw tracepoint context pointer in R1 when calling bpf_loop(). This is the smallest trigger for the incorrect precision backtracking: it reuses an existing callback and needs no maps or userspace setup. Expect an ordinary scalar-type rejection. Without the verifier fix, the test instead reaches precision backtracking and reports an internal "backtracking misuse" error. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260905014735.1452988-3-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-09-05selftests: tc-testing: update ETS test 41f5 for clamped quantaJamal Hadi Salim
Commit "net/sched: ets: clamp quantum in parse and fallback paths" moved the quantum floor into ets_quantum_parse(), so every explicitly configured quantum is now clamped to [256, 1 << 20], not just the psched_mtu() fallback. Test 41f5 passes "quanta 4294967294 1 1" and matches the values back verbatim, so all three bands now differ from what it expects: before: bands 3 quanta 4294967294 1 1 after: bands 3 quanta 1048576 256 256 Update the match pattern accordingly. Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Link: https://patch.msgid.link/QDISC-0CFC.v3.20260901204856@mojatatu.com.10 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-05tcp: Replace min_tso_segs() with tso_segs() CC callbackChia-Yu Chang
This patch replaces the existing min_tso_segs() callback with a new tso_segs() callback, allowing congestion control algorithms to provide an explicit TSO segment count for each data burst and bypass tcp_tso_autosize(). The resulting tso_segs value is clamped to [1, sk->sk_gso_max_segs], preventing congestion-control implementations from returning an invalid zero-segment value. This change has the following impacts on BPF struct_ops users: - The callback is renamed from min_tso_segs() to tso_segs() - The signature gains an extra u32 mss_now argument - The return value semantics is changed from "floor value passed into tcp_tso_autosize()" to "final tso_segs value", bypassing autosizing As a result, existing BPF programs must be updated, because returning a small constant will now directly limit the final tso_segs value instead of specifying the minimum value passed to tcp_tso_autosize(). Signed-off-by: Chia-Yu Chang <chia-yu.chang@nokia-bell-labs.com> Signed-off-by: Ilpo Järvinen <ij@kernel.org> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-04selftests/net: Fix flaky bind_wildcard due to ephemeral port raceRicardo B. Marlière (SUSE)
bind_wildcard picks an ephemeral port by binding fd[0] with port 0, reads it back with getsockname(), and then reuses that exact port number for the other addresses/families in fd[1..7]. This all happens in the default network namespace, so unrelated processes on the same host are drawing from the very same ephemeral port range (net.ipv4.ip_local_port_range) at the same time. Such a process can independently get assigned that exact port number on a different, non-conflicting address in the short window between fd[0]'s bind() and fd[1]'s, making fd[1]'s bind() fail with EADDRINUSE for reasons that have nothing to do with the wildcard-bind behavior under test, e.g.: # bind_wildcard.c:775:plain:Expected ret (-1) == 0 (0) # plain: Test terminated by assertion not ok N bind_wildcard.v6_local_v4_local.plain Fix it the same way so_incoming_cpu.c, tcp_port_share.c and reuseport_dualstack.c already do: unshare into a fresh network namespace and bring lo up, so there is nobody else to race with for the port. Signed-off-by: Ricardo B. Marlière (SUSE) <ricardo@marliere.net> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-04selftests/bpf: precision of a NULL global subprogram BTF_ID argumentEduard Zingerman
Check that mark_chain_precision() is called for a NULL pointer passed as an __arg_trusted __arg_nullable argument of a global subprogram. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-8-0f5a360ff15d@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: precision of a NULL kfunc argumentEduard Zingerman
Check that mark_chain_precision() is called for a NULL pointer passed as a __nullable kfunc memory argument. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-6-0f5a360ff15d@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: precision of a NULL global subprogram memory argumentEduard Zingerman
Check that mark_chain_precision() is called for a NULL pointer passed as a nullable pointer argument of a global subprogram. (Pointer arguments of the global subprograms are nullable by default). Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-4-0f5a360ff15d@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: precision of a NULL helper argumentEduard Zingerman
Check that mark_chain_precision() is called for a NULL nullable memory argument and for the zero flags argument of bpf_get_local_storage(). Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-2-0f5a360ff15d@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04bpf: mark a NULL call argument preciseEduard Zingerman
check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag. Fixes: b5dc0163d8fd ("bpf: precise scalar_value tracking") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-1-0f5a360ff15d@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests: tc-testing: add tx_queue_len cap regression testsJamal Hadi Salim
Add nine test cases for the S16_MAX tx_queue_len cap to the pfifo_fast suite. Netlink cases exercise the ifla_policy bound (2/3); the two new sysfs cases exercise the netif_change_tx_queue_len() choke point that 1/3 owns (SIOCSIFTXQLEN shares it; the ioctl is not portably reachable from tdc): - dbe3: set txqueuelen 32767 (S16_MAX) - accepted, pins the exact boundary value. - b50e: set txqueuelen 32768 - rejected with -ERANGE. - 40f8: write 32768 to /sys/class/net/*/tx_queue_len - rejected (covers patch 1/3 directly; netlink cannot reach this path). - 4b6e: write 32767 via sysfs - accepted, boundary positive control for the patch-1 path. - b90d: create a dummy with txqueuelen 32767 - accepted. - 57ab: create a dummy with txqueuelen 32768 - rejected at netlink parse time. - e777: create a dummy with txqueuelen 500000 - rejected (the v1 bypass path flagged by review). - 31ac: create a veth with an oversized txqueuelen on the peer nest - rejected (the peer nest is parsed against ifla_policy too). - b567: create a veth with txqueuelen on both ends within the cap - accepted (positive control for the peer nest). The three negative-creation verifies assert device absence ("ip -o link show" must not contain the device), not merely absence of a qlen pattern - the device does not exist when creation fails, so the exit code carries the signal and the verify adds content. The v1 04b5 "resize rollback" case is dropped: with the cap checked first, netif_change_tx_queue_len() returns -ERANGE before the write, the notifier or any qdisc resize, so the case exercised no resize and no rollback. It was also nondeterministic: pre-patch, the resize issues three ~11 MB kvmallocs for qlen 500000 which normally succeed, so the case passed on an unfixed kernel only under memory pressure - its outcome depended on the test host's free memory. Test commands run inside the netns, but nsPlugin creates the veth peer in the root namespace, so the teardown deletes the in-ns end only; deleting the peer via the pair is implicit. Note: iproute2 treats "txqueuelen" appearing after "type X" as a link-type attribute and silently drops it, so the creation cases place it before "type" to actually reach the kernel. Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Link: https://patch.msgid.link/QDISC-2899.v2.20260901233641@mojatatu.com.3 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-04vxlan: reject dynamic fdb entries that reference a nexthop idSeungwon Bae
The commit cited in the Fixes tag allowed VXLAN FDB entries to point to FDB nexthops so that overlay traffic could be load balanced across multiple VTEPs. Such entries can only be configured from user space, cannot be learned and cannot roam. They only make sense with a user space control plane such as E-VPN where data plane learning is disabled. Despite that, the VXLAN driver does not currently prevent such entries from being configured with the "dynamic" flag. The per-nexthop FDB list is only protected by the per-device hash lock, which is not sufficient when two VXLAN devices point to the same FDB nexthop and therefore share the list. Aging runs in softirq context without RTNL, so an entry deleted by one device can race with an addition or deletion from the other, leading to list corruption: list_del corruption. next->prev should be ffff8881069d9548, but was dead000000000122. (next=ffff8881069d9448) WARNING: CPU: 0 PID: 90 at lib/list_debug.c:65 __list_del_entry_valid_or_report+0x1aa/0x210 ... vxlan_fdb_destroy+0x5b8/0xad0 vxlan_cleanup+0x328/0x450 call_timer_fn+0x2a/0x1c0 run_timer_softirq+0x18c/0x210 BUG: KASAN: slab-use-after-free in vxlan_fdb_destroy Fix this by rejecting the bogus configuration of dynamic FDB entries that point to FDB nexthops, both when created and when an existing entry is updated. As such, the per-nexthop FDB list is only ever mutated under the RTNL lock. Add test cases to make sure that this does not regress in the future. Fixes: 1274e1cc4226 ("vxlan: ecmp support for mac fdb entries") Suggested-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Seungwon Bae <qotmddnjs@ajou.ac.kr> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260902155956.296699-1-qotmddnjs@ajou.ac.kr Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-04selftest: net: Specify netns for ip ntable in test_neigh.sh.Kuniyuki Iwashima
test_neigh.sh configures the following attributes in the root netns, but now these can be set per netns. * NDTA_THRESH1 / NDTA_THRESH2 / NDTA_THRESH3 * NDTPA_BASE_REACHABLE_TIME Let's specify netns for "ip ntable". Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260902203722.926528-16-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-04selftest: net: Deflake Periodic GC test in test_neigh.sh.Kuniyuki Iwashima
test_neigh.sh has a test case to check if GC is running periodically. It applies a new value to BASE_REACHABLE_TIME, waits for half of the old value (+2s) to ensure the config is reflected, and waits for BASE_REACHABLE_TIME to see if the next GC is triggered. orig_base_reachable=$(ip -j ntable show name "$tbl_name" | jq '.[] | \ select(has("thresh1")) | .["base_reachable"]') run_cmd "ip ntable change name $tbl_name thresh1 10 base_reachable 10000" run_cmd "sleep $(((orig_base_reachable / 1000) / 2 + 2))" This is because neigh_periodic_work() schedules the next GC with (BASE_REACHABLE_TIME / 2) seconds: queue_delayed_work(system_power_efficient_wq, &tbl->gc_work, NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1); However, the very first run is scheduled with a longer period in neigh_table_init(), which will be up to 45s: neigh_set_reach_time(&tbl->parms); queue_delayed_work(system_power_efficient_wq, &tbl->gc_work, tbl->parms.reachable_time); The initial value is randomly chosen, so if it is larger than 27s (larger than two "sleep"s), the test fails. The test fails more frequently when neigh_table is namespacified by the later patch. In addition, the long "sleep" makes the test more flaky on kernel with CONFIG_NO_HZ_IDLE=y, which is enabled by defconfig. The tbl->gc_work is initialised with INIT_DEFERRABLE_WORK() and queued to system_power_efficient_wq. Even when the next GC is supposed to be triggered 5s later, "sleep" makes the CPU idle, delaying GC execution until often 20s later, which is too late. Let's take the initial tbl->parms.reachable_time into account and poll periodic_gc_runs every 0.1s up to the proper timeout, not to make CPU idle. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260902203722.926528-2-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-04Merge tag 'drm-fixes-2026-09-05' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm fixes from Dave Airlie: "Lots of scattered fixes: nouveau has a bunch of display fixes for blackwell GPUs that should mean we light up monitors properly and fix some desktop rendering problems, amdgpu and intel display changes as usual. There also changes to the core pagemap, then the usual amouny of AI inspired validation fixes. core: - Fix drm_crtc_commit leak when PAGE_FLIP_EVENT is used dma-buf: - Publish the dma-buf only after copy_to_user succeeds - fix some kernel-doc warnings atomic-state-helpers: - set pixel_blend_mode to prop default on reset sysfb: - Fix integer overflow - fix constant comparison bug pagemap: - Prevent double migration of device pages - Reset migration page count on eviction retry - dma-unmap pages before handling migration errors - use after free fixes prime: - fix prime exports tracing amdgpu: - Fix for drm_amdgpu_info_device with mixed 64 bit kernel and 32 bit userspace - plane blend mode fixes - SR-IOV fix - GFX8 fix - MES queue reset fix - GPUVM fixes - DCN 6 warning fix - DCN 3.5/3.6 fix - DML fix - Backlight fix - Colorop fix - DC get_estimated_bw() fix - devcoredump fix - Userq fixes - APU PSP fix - Cursor fix amdkfd: - MES queue eviction fix - MQD debugfs fix xe: - oa uapi error handling fix - drm info message to report FLAT_CSS base misalignment i915: - Drop an accidentally duplicated panel fitter call in DP MST - Fix DDI clock programming for Cx0 and LT PHY - Fix PTL CDCLK handling at probe, causing a glitch - Fix dg2_power_well_count() return type - Fix a NULL pointer deref at forced probe - Fix selective fetch disable amdxdna: - out-of-bounds access fix - reject commands chains with no commands - handle chained mapping BO failures - refuse to flush an imported BO ethosu: - handle mmio mapping failures - handle storage modes only on hardware that supports it - fix job completion fence cleanup fastrpc: - Publish the dma-buf only after copy_to_user succeeds gud: - Improve TV modes and rotation handling nouveau: - use-after-free fixes - add missing scanline position support - HDMI and DP fixes - null pointer dereference fix - dmem accounting fixes for large folios - use write-combined maps for coherent qaic: - out-of-bounds access fix tegra: - Add blend mode properties virtio: - exit path and error handling fixes * tag 'drm-fixes-2026-09-05' of https://gitlab.freedesktop.org/drm/kernel: (83 commits) drm/xe/vram: report FLAT_CCS base misalignment MAINTAINERS, mailmap: use Aditya Garg's linux.dev account drm/amd/display: use plane color_mgmt_changed to track colorop changes drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit compile drm/amd/display: Fix cursor disable with horizontally split planes drm/amdgpu/userq: dont overwrite the error of subsequent map call drm/amdgpu: Skip accessing psp rum time db for APUs drm/amdgpu: update the fw version for gfx12 userqueues drm/amdgpu: update the fw version for gfx11 userqueues drm/amdgpu: fix byte/dword unit mismatch in coredump IB dump drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds drm/amd/display: fix division by zero in get_estimated_bw() drm/amd/display: use halving distribution for all encode-to-linear curves drm/amd/display: Fix backlight control for luminance-capable OLED drm/amd/display: Remove const Qualifier From Non-Pointer Fields drm/amd/display: Set gpuvm min page size to 4K on dcn35/36 drm/amd/display: Fix DCN5/6 DML2 compilation warnings drm/amdgpu: fix Idle BOs list in VM debugfs status info drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT drm/amdgpu: Update queue reset support version ...
2026-09-04selftests/bpf: Test inner map identities in callbacksKumar Kartikeya Dwivedi
Add load-only timer_mim coverage for inner map identities propagated through nested timer and bpf_for_each_map_elem() callbacks. The negative case initializes a timer in the second inner map with the map saved from the first inner map timer callback. The positive case pairs the timer value with the map supplied to the same for-each callback. Without the verifier fix, the mismatched-map program is accepted while the same-map control is rejected. Preserving map_uid reverses both verdicts. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260904104203.345917-9-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: Test imprecise scalar kptr storesKumar Kartikeya Dwivedi
Add a verifier regression where an imprecise zero scalar reaches a kptr store first and a nonzero scalar reaches the same instruction on a second path. Without the corresponding verifier fix, the second path is pruned and the program is unexpectedly accepted. With the fix, the scalar range is compared and the invalid store is rejected. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260904104203.345917-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: Test rhtab kptr cancellation semanticsNuoqi Gui
Resizable hash-map updates and deletions must not perform full special-field destruction in their caller context. In particular, a referenced kptr must remain attached to the allocation until the memory allocator destructor can release it safely. Add separate coverage for both affected paths. The update test stores a task kptr, replaces the ordinary value bytes with BPF_EXIST, and verifies that the kptr survived. The delete test removes an element and exchanges its kptr through the still-valid map-value pointer before the allocation is reclaimed. Both cases observe a NULL kptr when rhtab uses bpf_obj_free_fields(). They recover and release the reference after rhtab switches to cancellation semantics. Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn> [ kkd: Split update and delete coverage and rewrote the commit log ] Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260904104203.345917-5-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: Test timer field on recycled rhtab elementKumar Kartikeya Dwivedi
Exercise the rhtab special-field lifecycle with the sequence from the original report. A bpf_for_each_map_elem() callback deletes the sole element, then initializes and arms a timer through the callback value pointer while it remains valid. Use a one-element map and pin userspace and BPF execution to one CPU. Repeated delete-and-replace cycles drain the per-CPU allocator cache, and periodic RCU synchronization makes the deleted units available for recycling. After each replacement, a second BPF program calls bpf_timer_cancel() on its value. A successful cancellation proves both that a timer-bearing unit was recycled and that insertion preserved the timer field. Without the fix, insertion clears that field and cancellation keeps returning -EINVAL. A long expiration keeps the timer callback out of the test, so the regression is detected without accessing freed memory. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260904104203.345917-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0Jiayuan Chen
The bpf_nf test allocs a ct, sets snat and dnat with random addr and port via bpf_ct_set_nat_info(), then looks the ct up and checks the reply tuple against what was set. The port comes from bpf_get_prandom_u32() and can be 0. For bpf_ct_set_nat_info(), port 0 means "port not specified", so only the addr is mapped and the kernel keeps the original port. The check then compares that port with 0 and fails, which shows up as a flaky "Test for source natting" failure in CI [1][2]. Keep the random port in 1..65535 so it is always specified. [1] https://github.com/kernel-patches/bpf/actions/runs/33830002889/job/100893868791 [2] https://github.com/kernel-patches/bpf/actions/runs/33829976794/job/100893220999 Fixes: b06b45e82b59 ("selftests/bpf: add tests for bpf_ct_set_nat_info kfunc") Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Link: https://lore.kernel.org/r/20260904073745.363314-1-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: add tests to validate KASAN on JIT programsAlexis Lothoré (eBPF Foundation)
Add a basic KASAN test runner that loads and test-run programs that can trigger memory management bugs. The test captures kernel logs and ensure that the expected KASAN splat is emitted by searching for the corresponding first lines in the report, hence validated that the needed instrumentation has been inserted by the JIT compiler before the relevant memory accesses. To allow each test to trigger the expected report, the kernel must run with the kasan_multi_shot configuration. The runner covers different cases and settings: in the nominal case, it validates kasan reports on basic instructions (on all supported accesses sizes) but also when report _should not_ be emitted (eg: for accesses on program stack). The runner also comes with a few specialized tests that are then not executed for all sizes/locations: - specific atomic ops - test for instructions involving different verifier states, with some states flagging memory as stack, and other states as non-stack memory - tests that validate the stack marking shifting when a patch is emitted by the verifier (zext/rnd_hi32, constant blindind). Most of those tests are able to trigger kasan reports by altering the shadow memory (triggering faulty accesses is otherwise complex, because of the verifier). A few tests trigger actual faulty accesses (eg out-of-bound accesses) A few of those tests depends on cpuv4 (load_acquire/store_release, st, st_blinded), and so are executed only with test_progs-cpuv4 # ./test_progs -a kasan #175/1 kasan/st_1_not_on_stack:SKIP #175/2 kasan/st_1_on_stack:SKIP #175/3 kasan/st_2_not_on_stack:SKIP #175/4 kasan/st_2_on_stack:SKIP #175/5 kasan/st_4_not_on_stack:SKIP #175/6 kasan/st_4_on_stack:SKIP #175/7 kasan/st_8_not_on_stack:SKIP #175/8 kasan/st_8_on_stack:SKIP #175/9 kasan/stx_1_not_on_stack:OK #175/10 kasan/stx_1_on_stack:OK #175/11 kasan/stx_2_not_on_stack:OK #175/12 kasan/stx_2_on_stack:OK #175/13 kasan/stx_4_not_on_stack:OK #175/14 kasan/stx_4_on_stack:OK #175/15 kasan/stx_8_not_on_stack:OK #175/16 kasan/stx_8_on_stack:OK #175/17 kasan/ldx_1_not_on_stack:OK #175/18 kasan/ldx_1_on_stack:OK #175/19 kasan/ldx_2_not_on_stack:OK #175/20 kasan/ldx_2_on_stack:OK #175/21 kasan/ldx_4_not_on_stack:OK #175/22 kasan/ldx_4_on_stack:OK #175/23 kasan/ldx_8_not_on_stack:OK #175/24 kasan/ldx_8_on_stack:OK #175/25 kasan/simple_atomic_4_not_on_stack:OK #175/26 kasan/simple_atomic_4_on_stack:OK #175/27 kasan/simple_atomic_8_not_on_stack:OK #175/28 kasan/simple_atomic_8_on_stack:OK #175/29 kasan/simple_atomic_fetch_not_on_stack:OK #175/30 kasan/simple_atomic_fetch_on_stack:OK #175/31 kasan/load_acquire_1_not_on_stack:SKIP #175/32 kasan/load_acquire_1_on_stack:SKIP #175/33 kasan/load_acquire_2_not_on_stack:SKIP #175/34 kasan/load_acquire_2_on_stack:SKIP #175/35 kasan/load_acquire_4_not_on_stack:SKIP #175/36 kasan/load_acquire_4_on_stack:SKIP #175/37 kasan/load_acquire_8_not_on_stack:SKIP #175/38 kasan/load_acquire_8_on_stack:SKIP #175/39 kasan/store_release_1_not_on_stack:SKIP #175/40 kasan/store_release_1_on_stack:SKIP #175/41 kasan/store_release_2_not_on_stack:SKIP #175/42 kasan/store_release_2_on_stack:SKIP #175/43 kasan/store_release_4_not_on_stack:SKIP #175/44 kasan/store_release_4_on_stack:SKIP #175/45 kasan/store_release_8_not_on_stack:SKIP #175/46 kasan/store_release_8_on_stack:SKIP #175/47 kasan/ldx_patched_not_on_stack:OK #175/48 kasan/ldx_patched_on_stack:OK #175/49 kasan/verifier_paths_stack_and_non_stack:OK #175/50 kasan/ldx_oob_1_not_on_stack:OK #175/51 kasan/ldx_oob_2_not_on_stack:OK #175/52 kasan/ldx_oob_4_not_on_stack:OK #175/53 kasan/ldx_oob_8_not_on_stack:OK #175/54 kasan/ldx_self_alias_on_stack:OK #175/55 kasan/st_blinded:SKIP #175 kasan:OK (SKIP: 25/55) Summary: 1/30 PASSED, 25 SKIPPED, 0/0 FAILED Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com> Link: https://lore.kernel.org/r/20260903-kasan-v9-8-2407fe99255a@bootlin.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: add helpers for KASAN in JIT testingAlexis Lothoré (eBPF Foundation)
Add two simple helpers to allow checking whether KASAN for eBPF tests should be executed: - one helper to check if BPF_JIT_KASAN is enabled in kernel configuration - one helper to check if the kernel is running with kasan_multi_shot (otherwise only the first test will be able to trigger a report) Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com> Link: https://lore.kernel.org/r/20260903-kasan-v9-7-2407fe99255a@bootlin.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: make cmdline_contains stricterAlexis Lothoré (eBPF Foundation)
cmdline_contains is used by BPF selftests to check the presence of specific kernel commandline parameters, but it currently suffers from two issues: - the read commandline isn't NULL terminated right after the read data but only at the end of the buffer, leaving uninitialized bytes that are then possibly tokenized - the comparison of found tokens is done based on the size of found token. This could lead to too-short-but-matching tokens to wrongly match the search pattern. Enforce stricter checks in cmdline_contains to avoid accidental matches. Fixes: 399f6185a1c0 ("selftests/bpf: Fix selftests broken by mitigations=off") Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com> Link: https://lore.kernel.org/r/20260903-kasan-v9-6-2407fe99255a@bootlin.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04Merge tag 'hid-for-linus-2026090401' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - hid-hyperv build fixes on certain configs (Jiri Kosina) - HID-BPF fix and selftests now that the bpf verifier is more restrictive (Benjamin Tissoires) - Some AI detected fixes for OOB, errors and validation (Ibrahim Hashimov, Shen Yongchao, Wei Jie Law) - various device fixes (Dave Carey and Vadim Klishko) * tag 'hid-for-linus-2026090401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: bpf: serialize device reference release in struct_ops destroy path HID: rmi: fix OOB access with undersized RMI reports selftests/hid: prepare test_rdesc_fixup_get_data_overflow for the new verifier selftests/hid: Add a test to ensure we can write fields in hid_device HID: bpf: mark struct hid_device as safe BPF pointer HID: wacom: validate report length in wacom_intuos_pro2_bt_irq HID: multitouch: Fix stale MT slots when contact count drops to zero HID: i2c-hid: Add a quirk for a Cirque I2C device. HID: hyperv: make pointer arithmetics understandable for FORTIFY_SOURCE HID: hyperv: fix build breakage with certain configs
2026-09-04Merge tag 'sound-7.3-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes since 7.3-rc1. Quite a few fixes are for ALSA core for issues that have been detected by the things you know well. Additionally a series of hardening for runtime PM, and usual quirk updates, and some other misc driver fixes are included. Core: - Fixes for PCM races - UMP parser NULL dereference fix - Fix error handling in rawmidi ioctl USB- and HD-audio: - Implement missing runtime PM guards across multiple interfaces - Fix for OOB access in US-122L MIDI driver - Double-free fix for CAIAQ driver - Quirks for HD-audio Realtek & Cirrus codecs, Conexant S3-resume, USB Audient devices Others: - Fix of logical mistakes in dummy driver mixer and selftest code - Lock init fix in the legacy harmony driver" * tag 'sound-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (23 commits) ALSA: caiaq: Fix potential double-free at error path selftests/alsa: Fix the step check for INTEGER controls ALSA: hda/realtek: Fix cold-boot headset misdetection on Acer Aspire A515-57G ALSA: rawmidi: Return the error from snd_rawmidi_input_params() ALSA: ump: do not touch legacy_rmidi before it exists ALSA: hda/cs420x: Add CS4208 fixup for MacBookAir 7,2 ALSA: dummy: Report a change when one capture switch channel moves ALSA: usb-audio: Add mixer map quirk for Audient iD24 ALSA: hda: restore MFG widget enumeration after core split ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF ALSA: harmony: initialize locks before requesting IRQ ALSA: hda/realtek: Add quirk for VAIO VJS131 ALSA: pcm: Fix race between non-atomic ops and trigger-start ALSA: hda/realtek: Add quirk for Acer Predator PHN16-72 ALSA: hda/realtek: Add quirk for Lenovo Yoga Slim 9 14ILL10 ALSA: hda/conexant:Fix abnormal Mic/Speaker functionality on SN6140 after S3 wake-up ALSA: usb-audio: Guard FCP protocol transfers ALSA: usb-audio: Add PM guards to RME Digiface controls ALSA: usb-audio: Guard Scarlett2 protocol transfers ...
2026-09-04selftests/bpf: Reject refcount acquisition after RCU unlockNing Ding
Add a sleepable verifier test that loads a refcount-only local kptr in an explicit RCU read-side critical section, ends the section, and passes the pointer to bpf_refcount_acquire(). The loaded pointer never carries NON_OWN_REF. After RCU unlock it retains MEM_ALLOC while becoming PTR_UNTRUSTED, which previously made the kfunc argument check accept it as a live allocated object. Expect verification to reject the untrusted argument instead. Signed-off-by: Ning Ding <dingning04@gmail.com> [ kkd: Rewrote commit log ] Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260904084325.52250-9-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: Reject graph kptr use after RCU unlockKumar Kartikeya Dwivedi
Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: Test borrowed refcount acquisition nullabilityNing Ding
Add verifier coverage for the distinction between owning and borrowed arguments to bpf_refcount_acquire(). An owning pointer returned by bpf_obj_new() must continue producing a non-NULL result without an extra check. An RCU-loaded local kptr is only borrowed, so a checked result must load successfully while passing an unchecked result to bpf_obj_drop() must be rejected as possibly NULL. Use a sleepable syscall program for the borrowed cases so the explicit RCU critical section is what permits the local kptr load. Without the verifier fix, the unchecked case is incorrectly accepted. With it, the verifier rejects the possibly NULL argument. Signed-off-by: Ning Ding <dingning04@gmail.com> [ kkd: Rewrote commit log ] Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260904084325.52250-5-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: Reject non-percpu values in percpu kptr fieldsKumar Kartikeya Dwivedi
Add verifier coverage for the two ways a non-percpu pointer can be stored in a __percpu_kptr field: a program-BTF local allocation returned by bpf_obj_new(), and a referenced kernel-BTF task_struct pointer. Without the verifier fix, both programs are unexpectedly accepted and the negative tests fail. Requiring MEM_PERCPU makes both programs fail verification with the expected invalid-kptr diagnostic. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260904084325.52250-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04selftests/bpf: No non-NULL inference from an imprecise zero registerEduard Zingerman
Check that a register-form NULL check does not lift PTR_MAYBE_NULL on a path where the compared register is non-zero. W/o the previous patch the program is accepted. Reported-by: Nicholas Carlini <npc@anthropic.com> Suggested-by: Nicholas Carlini <npc@anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260904083325.2083493-8-eddyz87@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-09-04selftests/bpf: Check that JMP32 pointer vs zero jumps are not predictedEduard Zingerman
Add jmp32_ptr_vs_zero_jne: the fall-through of the 32-bit compare, which the verifier used to skip, contains an out of bounds map value access, hence w/o the previous patch the program is accepted. See previous patch for detailed description. Reported-by: Nicholas Carlini <npc@anthropic.com> Suggested-by: Nicholas Carlini <npc@anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260904083325.2083493-6-eddyz87@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-09-04selftests/bpf: Check the linked regs cap for the compared registerEduard Zingerman
linked_regs_too_many_regs checks that collect_linked_regs() ties at most LINKED_REGS_MAX registers for a single jump. Compare r5 instead of r0, so that the register the jump compares is itself the member that does not fit, and check that it comes out of the jump unlinked. W/o the previous patch env->{false,true}_reg{1,2} bring r5's id back and insn 7 is logged as "R5=scalar(id=1,...)". Reported-by: Nicholas Carlini <npc@anthropic.com> Suggested-by: Nicholas Carlini <npc@anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260904083325.2083493-4-eddyz87@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-09-04selftests/bpf: No non-NULL inference from unbounded offset pointersEduard Zingerman
Check that a comparison against a pointer whose offset is not bounded from above does not make the verifier infer that a nullable pointer is not NULL, and that a bounded offset still does. W/o the previous patch the first test is accepted. Reported-by: Nicholas Carlini <npc@anthropic.com> Suggested-by: Nicholas Carlini <npc@anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260904083325.2083493-2-eddyz87@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-09-04bfs: remove the filesystemEthan Nelson-Moore
BFS (not to be confused with BeFS, the BeOS filesystem) is the filesystem UnixWare uses for its boot partition. It has extremely limited functionality, only supporting contiguous files and no subdirectories. Even though the bfs driver is very small and is unlikely to cause future maintenance problems, given that the only type of data stored on such a partition is likely to be kernels and bootloader settings, there is very little reason anyone would want to access it from Linux. Other old Unix filesystems (efs, freevxfs) have been removed recently, and bfs is highly unlikely to have any users, so remove it as well. Retain the UAPI header to be safe. Also update the former maintainer's email address in CREDITS. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260904082954.48738-1-enelsonmoore@gmail.com Acked-by: Jan Kara <jack@suse.cz> Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Acked-by: Tigran Aivazian <aivazian.tigran@gmail.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-04selftests/livepatch: filter debug messages in check_result()Yafang Shao
CONFIG_DEBUG_KOBJECT makes kobject_add_internal(), kobject_uevent_env(), fill_kobj_path() and friends emit pr_debug() messages, and CONFIG_DEBUG_KOBJECT_RELEASE makes kobject_release() emit a pr_info() for every delayed kobject free. All of these carry the "kobject:" prefix via pr_fmt(), e.g.: # --- expected # +++ result # @@ -1,7 +1,13 @@ # % insmod test_modules/test_klp_livepatch.ko # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_add_internal: parent: 'module', set: 'module' # +kobject: 'holders' (000000002856f0ae): kobject_add_internal: parent: 'test_klp_livepatch', set: '<NULL>' # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_add_internal: parent: 'livepatch', set: '<NULL>' # +kobject: 'vmlinux' (000000007b8837e6): kobject_add_internal: parent: 'test_klp_livepatch', set: '<NULL>' # livepatch: enabling patch 'test_klp_livepatch' # livepatch: 'test_klp_livepatch': initializing patching transition # livepatch: 'test_klp_livepatch': starting patching transition # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_uevent_env # +kobject: 'test_klp_livepatch' (000000009dbf565e): fill_kobj_path: path = '/module/test_klp_livepatch' # livepatch: 'test_klp_livepatch': completing patching transition # livepatch: 'test_klp_livepatch': patching complete # % echo 0 > /sys/kernel/livepatch/test_klp_livepatch/enabled # @@ -9,4 +15,17 @@ livepatch: 'test_klp_livepatch': initial # livepatch: 'test_klp_livepatch': starting unpatching transition # livepatch: 'test_klp_livepatch': completing unpatching transition # livepatch: 'test_klp_livepatch': unpatching complete # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_release, parent 00000000f8785d63 (delayed 2000) # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_cleanup, parent 00000000f8785d63 # +kobject: 'test_klp_livepatch' (00000000dcae1113): auto cleanup kobject_del # +kobject: 'test_klp_livepatch' (00000000dcae1113): calling ktype release # +kobject: 'test_klp_livepatch': free name # % rmmod test_klp_livepatch # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_release, parent 0000000052e5c022 (delayed 3000) # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_cleanup, parent 0000000052e5c022 # +kobject: 'test_klp_livepatch' (000000009dbf565e): auto cleanup kobject_del # +kobject: 'test_klp_livepatch' (000000009dbf565e): auto cleanup 'remove' event # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_uevent_env # +kobject: 'test_klp_livepatch' (000000009dbf565e): fill_kobj_path: path = '/module/test_klp_livepatch' # +kobject: 'test_klp_livepatch' (000000009dbf565e): calling ktype release # +kobject: 'test_klp_livepatch': free name # # ERROR: livepatch kselftest(s) failed not ok 1 selftests: livepatch: test-livepatch.sh # exit=1 The livepatch test modules' kobjects are named "test_klp_*", so these lines match the check_result() grep for "test_klp" and leak into the result. The extra lines no longer match the expected output, so the selftests fail when either debug config is enabled. Filtering out every "kobject:" line also hides real WARN()s, e.g. the one kobject_get() emits for an object whose refcount was not initialized. Filtering with "dmesg --level=..." is not enough either, since the tests enable livepatch pr_debug() through dynamic_debug/control and expect its messages. Read the log with "dmesg --raw" and drop only the debug-level messages without the "livepatch:" prefix, plus the specific delayed-release info message. Suggested-by: Petr Mladek <pmladek@suse.com> Signed-off-by: Yafang Shao <laoar.shao@gmail.com> Acked-by: Song Liu <song@kernel.org> Reviewed-by: Petr Mladek <pmladek@suse.com> Tested-by: Petr Mladek <pmladek@suse.com> Link: https://patch.msgid.link/20260830054857.64758-3-laoar.shao@gmail.com Signed-off-by: Petr Mladek <pmladek@suse.com>
2026-09-04selftests: cover kernfs dentry revalidationShakeel Butt
kernfs_test only checked two xattr calls. It did not touch the part of kernfs that userspace hits most: the dentry cache. The kernel adds and removes kernfs nodes on its own, with no VFS call behind it, and removal cannot always unhash the dentries that are already cached. So ->d_revalidate() is what keeps the cache honest, let's add tests for it. Add tests that make the kernel change kernfs directly, instead of going through create and unlink: - writing cgroup.subtree_control makes the kernel add and remove files in every child cgroup. That checks two things: a cached negative dentry is dropped once the file appears, and a cached positive one is dropped once the file goes away. - renaming a network interface renames the sysfs node under a dentry that is already cached. - sysfs mounted in a new network namespace must list that namespace's interfaces and not the parent's, which covers the KERNFS_NS tagging code. - many lookups running against concurrent mkdir and rmdir. A lookup may only succeed or fail with an errno that means "it is gone". - open across removal, readdir returning each entry once, and a telldir()/seekdir() round trip, which uses the name hash cookie in kernfs_dir_pos(). Test the other direction too: walking dentries that are already cached must not drop them. That is not just a slowdown. d_invalidate() calls detach_mounts(), so a dentry dropped by mistake also unmounts whatever is mounted under that directory. Both filesystems are needed. cgroup2 has no ->rename and is not namespace tagged. sysfs cannot be mounted with a set of children we control. The config fragment stops a kernel built with kselftest-merge from passing while it runs almost nothing. To confirm the tests really catch a broken backstop, kernfs_dir_changed() was stubbed to return false. 8 of the 11 tests then failed. Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev> Link: https://patch.msgid.link/20260902014050.499002-1-shakeel.butt@linux.dev Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-04selftests/pidfd: fix PPID values in error messagePaul Dolan
The PIDFD_GET_INFO PPID check compares info.ppid against getppid(), but its failure message prints pid and info.pid from the preceding PID check. Print the PPID values being compared so that a failure reports the correct information. Fixes: cdda1f26e74b ("pidfd: add ioctl to retrieve pid info") Signed-off-by: Paul Dolan <paul.dolan.dev@gmail.com> Link: https://patch.msgid.link/20260902162615.11531-1-paul.dolan.dev@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-04selftests/clone3: tighten CLONE_CLEAR_SIGHAND conflict testPaul Dolan
The CLONE_CLEAR_SIGHAND test intends to verify that CLONE_CLEAR_SIGHAND and CLONE_SIGHAND are mutually exclusive. However, CLONE_SIGHAND without CLONE_VM is independently invalid, so the test input has another reason to fail with EINVAL. Add CLONE_VM so that CLONE_SIGHAND is otherwise valid, and require clone3() to fail with EINVAL. This ensures the test exercises the intended flag conflict and does not accept an unrelated failure. Fixes: de5287235631 ("tests: test CLONE_CLEAR_SIGHAND") Signed-off-by: Paul Dolan <paul.dolan.dev@gmail.com> Link: https://patch.msgid.link/20260902174939.15135-1-paul.dolan.dev@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-03selftests/bpf: Add tests to assert that netfilter progs cannot write to skbFlorian Westphal
The netfilter framework is allergic to ip header changing after validation done by ip/ipv6 stack. Assert that bpf netfilter programs do not allow skb write access. Following additional tests are expected to be rejected by verifier: 1. alter skb->len. 2. alter skb->data. 3. prog calls bpf_dynptr_slice_rdwr. 4. alter location returned by dynptr API. Add following test case for bpf runtime: - alter skb data via bpf_dynptr_write() Test checks via __retval() that bpf_dynptr_write() returned nonzero value. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev> Link: https://lore.kernel.org/r/20260903065845.22762-1-fw@strlen.de Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-03selftests/bpf: Reject legacy packet loads from callbacksKumar Kartikeya Dwivedi
Add verifier coverage for the callback restriction on legacy packet loads. Exercise BPF_LD_ABS directly in a bpf_loop callback and BPF_LD_IND from a static subprogram called by the callback, ensuring that callback context follows nested static calls. Also exercise a callback which reaches BPF_LD_IND through a global function and its static descendant. A sibling success case calls the same global chain outside a callback, preserving support for ordinary global packet loads. Existing success cases continue to cover loads from ordinary static subprograms. The failure cases expect the policy-specific rejection instead of reaching the implicit-return path, triggering a verifier warning, or being accepted through a function boundary. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260903214758.2727663-9-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-03selftests/bpf: Check faultable stack helper contextsKumar Kartikeya Dwivedi
Add verifier coverage for the sleepable bpf_get_stack() and bpf_get_task_stack() implementations. Call each helper while preemption is disabled and require the verifier to reject it as sleepable. Both programs load when the prototypes lack might_sleep, so the expected-failure tests fail. Keep success controls outside the non-preemptible region to ensure ordinary calls from sleepable uprobes remain valid. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260903214758.2727663-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-03selftests/bpf: Test btf lookup helper sleepabilityKumar Kartikeya Dwivedi
Add an expected failure case which calls bpf_btf_find_by_name_kind() from a BPF timer callback. Without the helper prototype being marked sleepable, the verifier accepts the program and the load unexpectedly succeeds. Also add a positive control which calls the helper directly from a syscall program. This verifies that marking the helper sleepable only rejects it in non-sleepable regions. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260903214758.2727663-5-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-03selftests/bpf: Check rbtree callback restrictions in subprogsKumar Kartikeya Dwivedi
Add a verifier failure case where an rbtree comparator enters two nested static subprograms and the innermost subprogram unlocks and relocks the tree. Restoring the lock keeps the surrounding callback state balanced, so the test specifically exercises whether the callback restriction follows the nested calls. Also add a load-only positive control whose comparator calls a harmless static subprogram. This preserves the intended support for verified static subprogram calls while holding the tree lock. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260903214758.2727663-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-03selftests/bpf: bpf_fastcall patterns entered by a jumpEduard Zingerman
Check bpf_fastcall pattern detection when the pattern is entered at an instruction other than the first spill: - a jump to the first spill allows the rewrite; - conditional/unconditional a jump to the call or to the fill does not allow the rewrite. Reported-by: Nicholas Carlini <npc@anthropic.com> Suggested-by: Nicholas Carlini <npc@anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260903205820.1743087-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-03selftests/bpf: check zero extension of an arena 32-bit cmpxchgEduard Zingerman
Add a test to verify that destination register of a 32-bit cmpxchg operating on an arena pointer is explicitly zero extended. W/o patch #1 this did not happen. Reported-by: Nicholas Carlini <npc@anthropic.com> Suggested-by: Nicholas Carlini <npc@anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260903171542.1438050-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-03Merge tag 'mm-hotfixes-stable-2026-09-03-17-45' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "18 hotfixes. 13 are cc:stable. 15 are for MM. All are singletons - please see the changelogs for details. There are no fixes (yet) for all the stuff we added in the most recent merge window. Hopefully a good sign" * tag 'mm-hotfixes-stable-2026-09-03-17-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/secretmem: properly account locked pages mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP MAINTAINERS: add Kiryl as a THP reviewer MAINTAINERS: cover all of RAID MAINTAINERS: mailmap: update entries for Thorsten Blum MAINTAINERS: remove Lorenzo as THP co-maintainer Revert "once: don't use a work queue to reset sleepable static key" mm/hugetlb: fix missing migratable flag on same-node hugetlb migration mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() mm/huge_memory: transfer the pmd dirty bit to the folio on zap MAINTAINERS: add Lance Yang as a hung task detector co-maintainer userfaultfd: reset err to be 0 when move_pages_ptes succeeded mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs mm/hugetlb: keep max_huge_pages when dissolving surplus folios mm/migrate_device: avoid out-of-bounds writes for compound folios mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON() memcg: make the v1 soft limit knob inert mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio
2026-09-03tunnels: Drop stale dst when building an ICMP error for PMTUDIdo Schimmel
Bridged UDP tunnels such as VXLAN and GENEVE build an ICMP error packet around an overlay packet if the packet is going to exceed the underlay path MTU. The ICMP error packet is then injected back into the Rx path with the source and destination addresses swapped, so that it will be delivered to the overlay source. If the overlay packet was routed to the UDP tunnel or locally generated, then it is already carrying a valid dst entry and this entry is not dropped when transforming the packet to an ICMP error packet. This causes the IP layer to reuse the dst entry, leading to the ICMP error packet being dropped or routed out of the UDP tunnel interface in case of forwarding. Prior to the blamed commit this could not happen, as skb_tunnel_check_pmtu() did not build ICMP errors for PACKET_HOST packets. Such packets were instead encapsulated and, unless the DF bit was set in the outer header, fragmented by the underlay. Fix this by making sure that the ICMP error packet does not have a valid dst entry, thereby forcing the IP layer to perform a route lookup. Adjust the bridged PMTU exception selftests accordingly. When the local sender in ns_a pings the overlay destination with a deadline (-w), ping exits on the first socket error before any reply is received and returns a non-zero exit code. The test therefore only passed because the ICMP error was never delivered. Use a packet count (-c) like the ns_c line above it, so that the ICMP error counts against the packet budget and the exit code depends on whether echo replies were received. This passes with and without the fix. Fixes: 8930424777e4 ("tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().") Cc: stable@vger.kernel.org Reported-by: Laika Price <laikabcprice@gmail.com> Closes: https://lore.kernel.org/netdev/20260614-master-v3-1-9f5060ba1ed1@gmail.com/ Reported-by: Yaroslav Dudkov <aroslavdudkov622@gmail.com> Closes: https://lore.kernel.org/netdev/20260901081825.287173-1-aroslavdudkov622@gmail.com/ Reported-by: Charles Bordet <rough.rock3059@datachamp.fr> Closes: https://lore.kernel.org/netdev/aHVhQLPJIhq-SYPM@eldamar.lan/ Signed-off-by: Ido Schimmel <idosch@nvidia.com> Tested-by: Yaroslav Dudkov <aroslavdudkov622@gmail.com> Reviewed-by: David Ahern <dsahern@kernel.org> Reviewed-by: Stefano Brivio <sbrivio@redhat.com> Reviewed-by: Guillaume Nault <gnault@redhat.com> Link: https://patch.msgid.link/20260902190112.4126199-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-03mm/secretmem: properly account locked pagesLorenzo Stoakes (ARM)
secretmem accounts folios by treating memory as if it were mlock()'d and thus limited by the RLIMIT_MEMLOCK limit. However the folios are unevictable and remain so until the inode is evicted, eliminating usual mlock() semantics - mapping folios then unmapping them does not clear their unevictable state, since it depends on AS_UNEVICTABLE, not PG_mlocked. A user can therefore easily work around the RLIMIT_MEMLOCK limit - simply map then unmap and VmLck no longer counts the secretmem range. Worse, folios are not accounted in the process's RSS, meaning the OOM killer won't know to kill the process. Repeatedly mapping/unmapping (or forking) can then result in the consumption of all available system memory with unevictable folios and cause system instability. A secretmem fd can be passed between processes and over fork so a per-process limit simply does not make sense, so follow the precedent set by io_uring, perf, skbuff, iommufd and xdp by tracking the number of locked pages in user_struct->locked_vm. Since the scope tracked is actually inode lifetime, the RLIMIT_MEMLOCK applies per-user not per-process, so it doesn't make sense to bypass for users with CAP_IPC_LOCK, therefore remove this bypass. There is simply no reason to carry on marking the mapping as mlock()'d since it's misleading and the lifecycle is now correctly handled, so remove this too. Note that secretmem does not support any form of truncation (including hole punching) and the folios are unreclaimable, so the folios need only be accounted on fault and unaccounted on inode destruction. __secretmem_account_pages() is more or less a duplicate of the code that io_uring etc. use, but since this is a bug fix that needs backporting, defer any de-duplication efforts to a follow-up. test_mlock_limit() asserts mlock_future_ok() on mmap(), however this has been removed, so remove the test altogether for the fix. A new test will be sent separately for upstream. Link: https://lore.kernel.org/20260826-secretmem-accounting-v3-1-94cb04399510@kernel.org Fixes: 1507f51255c9 ("mm: introduce memfd_secret system call to create "secret" memory areas") Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Reported-by: Daehyeon Ko <4ncienth@gmail.com> Closes: https://lore.kernel.org/linux-mm/20260813225328.2010303-1-4ncienth@gmail.com/ Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Tested-by: Daehyeon Ko <4ncienth@gmail.com> Cc: Alexei Starovoitov <ast@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: David S. Miller <davem@davemloft.net> Cc: Hagen Paul Pfeifer <hagen@jauu.net> Cc: Jakub Kacinski <kuba@kernel.org> Cc: James Bottomley <james.bottomley@HansenPartnership.com> Cc: Jesper Dangaard Brouer <hawk@kernel.org> Cc: John Fastabend <john.fastabend@gmail.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Stanislav Fomichev <sdf@fomichev.me> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-09-03Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc2). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>