summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
2026-09-11KVM: selftests: Use MEM_REGION_PT memslot instead of '0' for s390 ↵Sean Christopherson
regions/segments Use MEM_REGION_PT to indirectly specify memslot '0' instead of hardcoding the memslot in s390's virtual memory allocator, as a first step towards taking the allocation type instead of the exact, raw memslot in the physical memory allocator. Note, the only tests that set MEM_REGION_PT to a memslot other than '0' are arm64-only, i.e. s390 always uses memslot '0' for page tables. No functional change intended. Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com> Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Tested-by: Itaru Kitayam <itaru.kitayama@fujitsu.com> Link: https://patch.msgid.link/20260902164123.2546762-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-11KVM: selftests: Replace ulong with unsigned longHisam Mehboob
KVM selftests use the non-standard ulong alias in several files. glibc exposes the alias transitively through its headers, whereas musl does not, causing musl builds to fail with ulong undeclared. Use unsigned long directly instead of depending on a libc-specific typedef. This also avoids adding a duplicate typedef to a shared tools header. Reported-by: Aqib Faruqui <aqibaf@amazon.com> Closes: https://lore.kernel.org/r/20250829142556.72577-10-aqibaf@amazon.com Signed-off-by: Hisam Mehboob <hisamshar@gmail.com> Link: https://patch.msgid.link/20260803170825.925561-4-hisamshar@gmail.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-09-11iommufd/selftest: Skip when the mock device is not thereEva Kurchatova
Both iommufd tests need the mock device the iommufd module registers under CONFIG_IOMMUFD_TEST, and they open /dev/iommu in every fixture without checking, so on a kernel that does not provide it every case fails on the open. Checking the open is not enough on its own. /dev/iommu appears as soon as the iommufd module is loaded, which says nothing about the mock device: the release config here is CONFIG_IOMMUFD=m with CONFIG_IOMMUFD_TEST unset, so the open succeeds and the tests fail later in the ioctls that drive the mock device instead. Only the debug config sets CONFIG_IOMMUFD_TEST. /sys/bus/iommufd_mock covers both, it exists only once the module is loaded and the kernel was built with CONFIG_IOMMUFD_TEST. Check for it once before handing over to the harness, rather than in each of the fixtures, and report a skip. test_harness_run() is what TEST_HARNESS_MAIN calls anyway, so the tests still run exactly as they did. Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com> Link: https://patch.msgid.link/20260908214825.2682078-2-eva.kurchatova@virtuozzo.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-09-11kselftest/arm64: Fix size of thread_data values for pthread_join()Thomas Huth
pthread_join() stores the thread's return value (a "void *", i.e. 8 bytes on 64 bit computers) into the address that is passed as second parameter. However, the entries of thread_data are only normal "int"s, i.e. only 4 bytes. The additional 4 bytes of the return value clobber whatever is adjacent on the stack, i.e. other members of the thread_data array (which will be re-written in the next iteration of the for-loop, so that nobody noticed this problem), or another other local variable on the stack for the last iteration. Use "intptr_t" to declare the thread_data array entries with the correct size. Fixes: 29f080881601c ("kselftest/arm64: check GCR_EL1 after context switch") Cc: stable@vger.kernel.org Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-09-10selftests: ublk: add batch IO cases to recover_03Yang Xiuwei
Add -b coverage for quiesce recover. Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn> Reviewed-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20260821103047.369522-3-yangxiuwei@kylinos.cn Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-10selftests: net: add ctl_file_write() helperJakub Kicinski
Setting a sysctl or a sysfs attribute for the duration of a test and putting the old value back has been open coded multiple times. We generally avoid creating library helpers but this one is very common, and the defer is a little tricky as using the same function for defer as the initial write leads to an infinite loop (not that I would ever make such mistake!) Some of the conversions are not identical, but arguably ctl_file_write() semantics are more correct. Reviewed-by: Nimrod Oren <noren@nvidia.com> Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260909180009.1894019-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-10selftests/bpf: Test bpf_sock_destroy() on TIME_WAIT and listener socksJiayuan Chen
Add two subtests. tcp_timewait: the client shuts down first and the server closes after it, so the client sock ends up in TIME_WAIT. A tcp iterator then finds the timewait sock by the cookie it inherited from the client sock and destroys it. Iterate once more to make sure it is gone. Without the first fix bpf_sock_destroy() reads past the timewait sock and KASAN complains. tcp_listen_pending: connect to a listener but never accept, so the child sits in the accept queue, then destroy the listener. Without the second fix the cond_resched() in inet_csk_listen_stop() trips the might_sleep check under rcu_read_lock(). ./test_progs -a sock_destroy #444/1 sock_destroy/tcp_client:OK #444/2 sock_destroy/tcp_server:OK #444/3 sock_destroy/tcp_listen_pending:OK #444/4 sock_destroy/tcp_timewait:OK #444/5 sock_destroy/udp_client:OK #444/6 sock_destroy/udp_server:OK #444/7 sock_destroy/trace_tcp_destroy_sock:OK #444 sock_destroy:OK Summary: 1/7 PASSED, 0 SKIPPED, 0/0 FAILED Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Link: https://lore.kernel.org/r/20260910112810.153801-1-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-10selftests/bpf: Test BTF walk into a flexible array of zero-sized elementsJiayuan Chen
The program stashes a bpf_obj_new() object whose type ends with a flexible array of empty structs, then reads it back as an untrusted kptr. Without the previous patch this divides by zero in btf_struct_walk() instead of being rejected. # ./test_progs -t verifier_btf_flex_array ... #602 verifier_btf_flex_array:OK Summary: 1/1 PASSED, 0 SKIPPED, 0/0 FAILED Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Link: https://lore.kernel.org/r/20260910122316.186384-2-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-10selftests/bpf: Add tests for the KF_PERFMON gatesDaniel Borkmann
Add test cases where each one loads with CAP_BPF alone and checks that the program is correctly rejected. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_kfunc_perfmon [...] #627/1 verifier_kfunc_perfmon/rdonly_cast_noperfmon:OK #627/2 verifier_kfunc_perfmon/rdonly_cast_noperfmon @unpriv:OK #627/3 verifier_kfunc_perfmon/probe_read_kernel_dynptr_noperfmon:OK #627/4 verifier_kfunc_perfmon/probe_read_kernel_dynptr_noperfmon @unpriv:OK #627/5 verifier_kfunc_perfmon/stream_vprintk_noperfmon:OK #627/6 verifier_kfunc_perfmon/stream_vprintk_noperfmon @unpriv:OK #627/7 verifier_kfunc_perfmon/get_kmem_cache_noperfmon:OK #627/8 verifier_kfunc_perfmon/get_kmem_cache_noperfmon @unpriv:OK #627/9 verifier_kfunc_perfmon/arg_untrusted_read_noperfmon:OK #627/10 verifier_kfunc_perfmon/arg_untrusted_read_noperfmon @unpriv:OK #627 verifier_kfunc_perfmon:OK Summary: 1/10 PASSED, 0 SKIPPED, 0/0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260910213510.49358-4-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-10Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc3). Conflicts: drivers/net/dsa/mt7530.c 3c18e3c9a54e ("net: dsa: mt7530: populate lpi_interfaces to fix EEE support") 10d9d8328e8a ("net: dsa: mt7530: replace mt7530_read with regmap_read") Adjacent changes: drivers/net/bonding/bond_alb.c 1746ef2e2df2 ("bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()") 4cef95f72bbd ("bonding: fix u32 overflow in compute_gap()") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-10Merge tag 'net-7.3-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Nothing too exciting, usual stream of fixes. Including fixes from Netfilter, Bluetooth and WPAN. Current release - new code bugs: - Bluetooth: hci_sync: fix not setting CE length properly - eth: enic: match mailbox replies to request numbers Previous releases - regressions: - tunnels: drop stale dst when building an ICMP error for PMTUD - ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() (bug in the rtnl_lock -> RCU conversion) - eth: bnxt_en: - fix crashes on Thor2 due to OOB coalescing buffer accesses - prevent queue stop with deferred completions Previous releases - always broken: - eth: - ice: don't dereference pointers from TP_printk() - fix OOB writes on ethtool flow rule dump in 3 drivers - mlx5: fix FEC configuration with RS_544_514_INTERLEAVED_QUAD - dsa: tag_brcm: legacy FCS: request needed tailroom Misc: - net: cap tx_queue_len at S16_MAX to prevent oversized ring alloc - ipv6: flowlabel: cap duplicate leases per socket" * tag 'net-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (164 commits) selftests: tc-testing: test action batch failure cleanup net/sched: act_api: release all action references on NEWACTION failure openvswitch: fix wrong flag value in get_ipv6_ext_hdrs() ipmr: account multicast table and route memory net: phy: dp83td510: handle the active-high LED polarity mode net: macb: initialize PTP state before registering clock net: hsr: enable promiscuous mode on interlink port with fwd offload ipv6: fix fib6 walker UAF on seq stop net: stmmac: fix TX descriptor availability check for TSO traffic net/rds: fix tcp stream corruption with large pages net: mana: restore the XDP program pointer when pre-allocation fails net: phy: dp83867: handle the active-high LED polarity mode octeontx2-af: fix PF/CGX debugfs PCI bus lookup net: net_failover: Fix the deadlock in net_failover_slave_name_change() net: phy: mediatek-ge: disable EEE on the MT7530 PHY tcp: reject non zerocopy devmem tx net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support net: dsa: mt7530: populate lpi_interfaces to fix EEE support net: hinic: fix mailbox segment buffer overflow net: sun4i-emac: fix missing of_node_put() for phy_node ...
2026-09-10selftests: ublk: install test_common.sh and trace/ scriptsMahmoud Nagy Adam
Every ublk test script sources test_common.sh from its own directory: . "$(cd "$(dirname "$0")" && pwd)"/test_common.sh and test_generic_02/12 additionally run bpftrace against the scripts in trace/. Neither test_common.sh nor trace/ is listed in TEST_FILES, so "make install" does not copy them into the install directory and every ublk test fails when run from there: ./test_generic_02.sh: line 4: .../kselftest_install/ublk/test_common.sh: No such file or directory ./test_generic_02.sh: line 8: _have_program: command not found The bpftrace tests are affected even when bpftrace is installed: the missing trace/*.bt makes bpftrace exit immediately, and the tests then report a skip rather than a failure, which hides the problem. Add both to TEST_FILES, matching how other selftests ship their sourced helpers (see kexec/kexec_common_lib.sh and zram/zram_lib.sh). Fixes: 6aecda00b7d1e1 ("selftests: ublk: add kernel selftests for ublk") Fixes: 723977cab4c0fd ("selftests: ublk: add generic_01 for verifying sequential IO order") Cc: stable@vger.kernel.org # v6.15+ Assisted-by: Kiro:claude-opus-5 Signed-off-by: Mahmoud Nagy Adam <mngyadam@amazon.de> Reviewed-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20260909132602.68852-2-mngyadam@amazon.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-09-10selftests: tc-testing: test action batch failure cleanupXuanqiang Luo
Add tests for cleanup after a batched RTM_NEWACTION request fails. Replace an existing gact action bound to a filter, then fail a later entry by requesting goto chain without a classifier context. Check that the bound action's reference count returns to its original value. Also cover a successfully initialized new action between the bound action and the failing entry, verifying that its reserved index can be reused. Repeat the bound action in another batch to check that each temporary reference to the same action is released. Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn> Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com> Link: https://patch.msgid.link/20260909070336.32979-3-xuanqiang.luo@linux.dev Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-10selftests: net: fix repeated word 'use' in commentHemanth Selam
Drop the second 'use', reported by checkpatch.pl as a possible repeated word. Only touches a comment, no code changes. Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260908052602.27497-3-hemanth.selam@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-10sysctl: Add 0013 to test partially updated vectorsJoel Granados
Add coverage for partially updated sysctl vectors with test 0013. It makes sure that the sysctl vector is unchanged when one of the elements is not valid. Reviewed-by: Bradley Morgan <include@grrlz.net> Signed-off-by: Joel Granados <joel.granados@kernel.org>
2026-09-10memblock tests: cover allocations below the low address limitTianyi Chen
Add memblock_alloc_low() coverage using the simulator's low address limit. Exercise aligned allocation, an allocation whose last byte is immediately below the limit, an alignment constraint that prevents fitting below it, and fully reserved low memory with high memory still available. Run each case with bottom-up and top-down allocation. Check zeroing and reserved-region accounting as well as returned addresses. Verify that an unrestricted allocation can use the free high memory after the low allocation fails. Document the simulated limit and remove the completed TODO. Assisted-by: LLM Signed-off-by: Tianyi Chen <hi@tychen.cc> Link: https://patch.msgid.link/142ab1025fd1e4b5dcd2a1591b964626ebce9d23.1788997523.git.hi@tychen.cc Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-09-10memblock tests: model the low allocation limit within dummy memoryTianyi Chen
The simulator represents physical addresses using the address of its allocated buffer. That buffer can lie above the default ARCH_LOW_ADDRESS_LIMIT, preventing meaningful memblock_alloc_low() tests. Use the architecture override in asm/dma.h to place the limit halfway through the memory registered by setup_memblock(). Resolve the limit after allocating the buffer, leaving registered memory on both sides. Assisted-by: LLM Signed-off-by: Tianyi Chen <hi@tychen.cc> Link: https://patch.msgid.link/f16c272cd52316b83c35d87987b4d8687c4a3182.1788997523.git.hi@tychen.cc Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-09-10selftests/tc-testing: Add cls_route bucket move and change testsVictor Nogueira
Add 4 tdc tests for the cls_route bugs fixed earlier in this series: - Delete a route filter that was moved to another bucket (a7d2): Validates that deleting a filter, and making a bucket empty, does not leave a dangling empty bucket - Try to change a route filter onto an already used handle (c05a): Validates that attempting to change an existing filter's handle to an already taken one fails - Replace a route filter that shares its key with another filter (3f21): Validates that an in-place replace keeps the handle userspace named the filter by, rather than dropping the 0x7F00 bits from it - Replace both route filters sharing a key (9d0e): Validates that replacing one of the two does not make the other one unreplaceable Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Victor Nogueira <victor@mojatatu.com> Link: https://patch.msgid.link/20260907192133.2639067-5-victor@mojatatu.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-10selftests/powerpc: use MAP_FAILED instead of (void *)-1 in ↵longlong yan
tm-signal-context-force-tm mmap() is documented to return MAP_FAILED on error, but tm-signal-context-force-tm.c compares the return value against (void *)-1. Replace these with the standard MAP_FAILED macro for better readability and type safety. Signed-off-by: longlong yan <yanlonglong@kylinos.cn> Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260722023428.932-1-yanlonglong@kylinos.cn
2026-09-10selftests/powerpc/tm: Fix tcheck() reading uninitialised CR valueThibault Ferrante
tcheck() is used to check the current transaction state (active, suspended, doomed) via the "tcheck" instruction, which writes its result into CR field 0. The inline asm declared a GPR output operand for this result but never actually moved the CR into it. Every caller (tcheck_doomed(), tcheck_active(), tcheck_suspended(), tcheck_transactional()) has effectively been testing bits of an unrelated, arbitrary register value since this helper was introduced. The "& 4" mask discards the TDOOMED and TS_lsb (suspended) bits before they ever reach the callers, so tcheck_doomed() and tcheck_suspended() can never return true, and tcheck_transactional() degrades to being equivalent to tcheck_active(). Fix tcheck() to actually move CR into the output register with mfcr, and widen the mask from "& 4" to "& 0xf" so the full CR0 nibble (TDOOMED | TS_msb | TS_lsb | reserved) is preserved for the callers. This bug has been present since tcheck() was introduced. Link: https://bugs.launchpad.net/bugs/2107442 Fixes: 8e03bd4e70b6 ("selftests/powerpc: Add TM tcheck helpers in C") Signed-off-by: Thibault Ferrante <thibault.ferrante@canonical.com> Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Closes: https://lore.kernel.org/all/364996ce-aba2-4213-8d20-7dd481b43fe6@linux.ibm.com/ Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260907215420.1258678-1-thibault.ferrante@canonical.com
2026-09-10selftests: cover kernfs file handles and same-parent renameShakeel Butt
The kernfs tests only reach kernfs through lookup and readdir. Two paths are not covered: file handles, which find a node without a lookup through its parent, and rename of a node that keeps its parent. Add three tests: - decode a file handle, live and after the node is gone; - decode while the node is being removed; - look up a name while an interface is renamed, which renames its /sys/class/net entry with the parent unchanged. Two small fixes while here. ns_tag_isolates_class_net now counts only symlinks, because bonding adds a bonding_masters attribute that is not a device. A failing mkdtemp() now skips instead of aborting. Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev> Link: https://patch.msgid.link/20260905191613.3143937-2-shakeel.butt@linux.dev Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-10selftests/filesystems: fix missing and stale TARGETS entriesDisha Goel
filesystems/eventfd, filesystems/open_tree_ns and filesystems/xattr were never added to TARGETS when introduced. filesystems/openat2 was moved from selftests/openat2/ but the TARGETS entry was never updated, leaving a stale entry pointing at a directory that no longer exists. Fix this by adding the four missing subdirectories to TARGETS and removing the stale openat2 entry. Link: https://lore.kernel.org/20260703150742.58991-1-disgoel@linux.ibm.com Fixes: 7c37857fc23a ("selftests: add eventfd selftests") Fixes: b8f7622aa6e3 ("selftests/open_tree: add OPEN_TREE_NAMESPACE tests") Fixes: 7e28fef5d4db ("selftests/xattr: path-based AF_UNIX socket xattr tests") Fixes: fe087927046c ("selftests: move openat2 tests to selftests/filesystems/") Signed-off-by: Disha Goel <disgoel@linux.ibm.com> Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org> Cc: "Darrick J. Wong" <djwong@kernel.org> Cc: Jan Kara <jack@suse.cz> Cc: Jeff Layton <jlayton@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Wen Yang <wenyang.linux@foxmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Link: https://patch.msgid.link/20260904183659.B81CD1F00A3D@smtp.kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-10selftests/powerpc/pmu/ebb: fix lost_exception_test hang with sched yield changeAthira Rajeev
commit 79104becf42b ("sched/fair: Forfeit vruntime on yield") changed yield_task_fair() to only bump the deadline when the entity is eligible (vruntime <= avg_vruntime). When the entity is ineligible the yield becomes a complete no-op from scheduling perspective. lost_exception_test calls sched_yield() 100,000 times per iteration to race the EBB exception delivery with a context switch to the eat_cpu companion process. After enough iterations the test process's vruntime races ahead of avg_vruntime (each eligible yield bumps vruntime to deadline, then advances deadline by one slice). Once ineligible, yield_task_fair() does nothing: so the scheduler won't pick the eat_cpu child. No context switch occurs, the PMAO race is never triggered, and ebb_count stays at 0 forever causing the test to hang until timeout. Fix by replacing sched_yield() with nanosleep(0, 1ns). nanosleep() goes through hrtimer_nanosleep() -> do_nanosleep(), which puts the task into TASK_INTERRUPTIBLE and removes it from the run queue entirely. This guarantees the scheduler picks the eat_cpu child, restoring the context-switch guarantee the test requires. The 1ns duration is enough to engage the hrtimer path while keeping the sleep effectively instantaneous; the same race window between PMU overflow and context switch is preserved. Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Signed-off-by: Athira Rajeev <atrajeev@linux.ibm.com> Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260903074036.63309-1-atrajeev@linux.ibm.com
2026-09-09selftests: icmp_redirect: remove xfail supportEric Dumazet
Commit 0a36a75c6818 ("selftests: icmp_redirect: support expected failures") added xfail support to icmp_redirect.sh because the test "IPv6: mtu exception plus redirect" was failing at the time due to a perceived kernel bug described in commit 99513cfa16c6 ("selftest: Fixes for icmp_redirect test"). However, commit 0e02bf5de46a ("selftests: icmp_redirect: IPv6 PMTU info should be cleared after redirect") subsequently fixed the test logic: after redirecting to a new path, the old PMTU information should indeed be cleared, so the test was adjusted to verify the redirect without the old PMTU. Since that fix, the test has been passing and is no longer expected to fail. Leaving xfail=1 in log_test() for all IPv6 tests was not only obsolete, but had the undesirable side effect of masking any future IPv6 failure as XFAIL instead of FAIL. Furthermore, commit 3748939bce3f ("selftests: icmp_redirect: pass xfail=0 to log_test()") had to work around a bash syntax error caused by the empty xfail argument on IPv4 tests. Remove the obsolete xfail support from log_test() and restore standard pass/fail reporting across all tests. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260908091327.349091-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09selftests/net: skip srv6_end_dt[4/6]_l3vpn_test.sh if vrftable not availableAlessio Faina
In case iproute2 is older than version 5.11.0, released ~Feb 23, 2021, the vrftable support is not available and the tests contained in the following 2 test files - srv6_end_dt4_l3vpn_test.sh - srv6_end_dt6_l3vpn_test.sh are failing in some kernel backports. This is the result of one of those tests in an unsupported environment: ########################################################################## TEST SECTION: SRv6 VPN connectivity test among hosts in the same tenant ########################################################################## TEST: Hosts connectivity: hs-t100-1 -> hs-t100-2 (tenant 100) [FAIL] TEST: Hosts connectivity: hs-t100-2 -> hs-t100-1 (tenant 100) [FAIL] TEST: Hosts connectivity: hs-t200-3 -> hs-t200-4 (tenant 200) [FAIL] TEST: Hosts connectivity: hs-t200-4 -> hs-t200-3 (tenant 200) [FAIL] The test installs a route with the vrftable feature; if this feature is not available, the approach taken is to skip the test rather than failing it. Signed-off-by: Alessio Faina <alessio.faina@canonical.com> Reviewed-by: Andrea Mayer <andrea.mayer@uniroma2.it> Link: https://patch.msgid.link/20260907100631.1923148-1-alessio.faina@canonical.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-10selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tcSven Schnelle
The current regex also matches symbols in modules, which makes the test fail on s390 where name_show is present only once in the kernel, but also multiple times in modules: 000001b1401cdc20 t name_show 000001b0c05e6c40 t name_show [mdev] 000001b0c0495f30 t name_show [i2c_core] Fix this by changing the regular expression to only match the function name. Link: https://lore.kernel.org/all/20260909092954.2200558-1-svens@linux.ibm.com/ Fixes: 03b80ff8023a ("selftests/ftrace: Add new test case which checks non unique symbol") Signed-off-by: Sven Schnelle <svens@linux.ibm.com> Reviewed-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-09-09selftests: forwarding: use KHDR_INCLUDES in CFLAGSMatthieu Baerts (NGI0)
KHDR_INCLUDES is typically used to include headers from the kernel source directory instead of only relying on the ones from the host: they can be missing or outdated. The kselftest doc recommends assigning KHDR_INCLUDES to CFLAGS in a target Makefile. lib.mk will set KHDR_INCLUDES to "-isystem $(top_srcdir)/usr/include" if the user didn't set it, e.g. if the kernel was built in a different build directory. Other net targets have KHDR_INCLUDES added to their CFLAGS. Link: https://docs.kernel.org/dev-tools/kselftest.html#contributing-new-tests-details Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Reviewed-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260904-net-sft-nf-khdr_includes-v1-2-92455af428e9@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09selftests: netfilter: use KHDR_INCLUDES in CFLAGSMatthieu Baerts (NGI0)
KHDR_INCLUDES is typically used to include headers from the kernel source directory instead of only relying on the ones from the host: they can be missing or outdated. The kselftest doc recommends assigning KHDR_INCLUDES to CFLAGS in a target Makefile. lib.mk will set KHDR_INCLUDES to "-isystem $(top_srcdir)/usr/include" if the user didn't set it, e.g. if the kernel was built in a different build directory. Other net targets have KHDR_INCLUDES added to their CFLAGS. Link: https://docs.kernel.org/dev-tools/kselftest.html#contributing-new-tests-details Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Reviewed-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260904-net-sft-nf-khdr_includes-v1-1-92455af428e9@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09selftests: net: Skip so_incoming_cpu on single-CPU systemsKuba Pawlak
The test requires at least two CPUs to exercise the distribution of connections between per-CPU listeners. It currently enforces this prerequisite with an assertion, causing all test cases to fail on single-vCPU systems even though no kernel functionality was tested. Report the unsupported environment as a skip instead. Check the prerequisite before setting up the network namespace so skipped tests do not make unnecessary system changes. Link: https://bugs.launchpad.net/ubuntu-kernel-tests/+bug/2023546 Signed-off-by: Kuba Pawlak <kuba.pawlak@canonical.com> Link: https://patch.msgid.link/20260904140334.562593-1-kuba.pawlak@canonical.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09selftests: rtnetlink: update ipsec_offload expected outputAndrei Gherzan
The previous patch ("netdevsim: print IPsec salt/key in network byte order") makes the netdevsim IPsec debugfs file print salt/key in network byte order on every host, instead of host CPU byte order. Update the expected output of kci_test_ipsec_offload() to match: the values change from the little-endian-only representation to the new, endianness-independent one. No other changes are needed since the output is now the same on every architecture. This depends on the previous driver patch: applied on its own, this change would regress the test on little-endian hosts (which still print the old host-order value), though it happens to have no effect on big-endian hosts (whose old host-order output already matched). Reported-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> Link: https://lore.kernel.org/netdev/20220308135106.890270-1-kleber.souza@canonical.com/ Signed-off-by: Andrei Gherzan <andrei.gherzan@canonical.com> Link: https://patch.msgid.link/20260908140325.13367-3-andrei.gherzan@canonical.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09selftests: mptcp: lib: get counters for the right testMatthieu Baerts (NGI0)
When the value for a MIB counter is required, mptcp_lib_get_counter is called. It tries to use the cache, if available. If not it falls back to calling 'nstat' directly by looking at the absolute counters. That's an issue for tests that don't recreate the netns for each subtest. In this case, 'nstat -a' will look at the counters for the netns. Instead, it should look at the increment for the current test, by using the history recorded in /tmp/<ns>.nstat, if available, and not using '-a' which was dumping the absolute values. While at it, rename the previous 'hist' variable to 'cache' as it was used to look at the cache, not the nstat history. Fixes: 71388a9f331d ("selftests: mptcp: lib: get counters from nstat history") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang <geliang@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-12-df1de70348b6@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09selftests: mptcp: lib: dump nstat for the right testMatthieu Baerts (NGI0)
In case of errors, mptcp_lib_pr_nstat is called to dump the nstat counters, but for some tests, it was dumping the counters for all subtests, not just the current one. That's an issue for tests that don't recreate the netns for each subtest, e.g. mptcp_connect.sh. In this case, 'nstat -a' will look at the absolute counters since the creation of the netns, making debugging harder. Instead, it should dump the counters for the current test, by using the history recorded in /tmp/<ns>.nstat if available, and not using '-a' which was dumping the absolute values instead of calculating increments. While at it, rename the previous 'hist' variable to 'cache' as it was used to look at the cache, not the nstat history. Fixes: 658e53141780 ("selftests: mptcp: join: dump stats from history") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang <geliang@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-11-df1de70348b6@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09selftests: mptcp: fix an UAF in mptcp_connect.cGang Yan
At the end of 'sock_connect_mptcp()', it calls 'freeaddrinfo(addr)', the 'peer' pointer (which points into 'addr') remains. Later, the main loop uses this peer pointer for reconnection attempts. If the memory has been freed and reused, the address data could be overwritten, resulting in an invalid remote address. This patch keeps the addrinfo list allocated for the whole process lifetime so "peer" remains valid across reconnects; the memory will be released at exit() time. Fixes: 05be5e273c84 ("selftests: mptcp: add disconnect tests") Cc: stable@vger.kernel.org Suggested-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Gang Yan <yangang@kylinos.cn> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-7-df1de70348b6@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09selftests: drv-net: warn if LOCAL_V6 has DAD or not kept on link downJakub Kicinski
napi_id.py intermittently fails to start its helper on Intel and Google HW runners: CMD: /srv/netdev/drivers/net/napi_id_helper 3001::1 37569 EXIT: 1 STDERR: bind failed: Cannot assign requested address Either keep_addr_on_down is not set or more likely the address is configured without nodad. Having to make sure that all tests always wait for DAD after impacting the link would be a whack-a-mole so we expect the env to have nodad and keep_addr_on_down set. Warn about both while validating the environment, and document this. We could fail completely but most tests don't impact the link so for quick local testing it'd be annoying to have to apply the settings. I hope the warninging stikes the right balance. Link: https://patch.msgid.link/20260908181956.1357684-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09selftests: net: csum: filter packets by source address and portWillem de Bruijn
Add source address and port verification in recv_verify_packet_* and recv_udp: non-matching packets are skipped. The receiver reads from PF_PACKET and UDP sockets to verify incoming packets to test hardware checksum offload. It did not validate the packet source address or source port. During tests expecting an invalid checksum (-E) or zero checksum (-Z), background packets can fail the test. For -Z, build_packet_udp chooses a specific source port that causes the checksum to sum to zero. When running in receive-only mode (-R), call build_packet in do_rx to compute the expected source port so that source port filtering can be applied to -Z as well. Also - add an inter-packet delay to avoid drops from bursts. - remove a comment that is no longer correct. Fixes: 91a7de85600d ("selftests/net: add csum offload test") Signed-off-by: Willem de Bruijn <willemb@google.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260908155537.813889-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-09selftests/sched_ext: Validate select_cpu_and mask constraintsTianyi Chen
The syscall test only prints the CPU selection result after checking whether BPF_PROG_TEST_RUN succeeds. Require -EBUSY for empty and affinity-disjoint custom masks, and allow a legal singleton candidate to be selected or busy. Reject unexpected errors and selections outside the custom mask or configured affinity. Check cpus_mask because migration disabling can temporarily narrow cpus_ptr under CONFIG_PREEMPT_RCU. Grow dynamically allocated affinity masks until sched_getaffinity() succeeds, retaining that allocation size for pinning and restoration. Restore affinity on all exits after pinning, and skip only the disjoint case when fewer than two CPUs are allowed. Assisted-by: LLM Signed-off-by: Tianyi Chen <hi@tychen.cc> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-09-09selftests/sched_ext: Drop -rdynamic and stop clobbering LDFLAGSCheng-Yang Chou
CFLAGS passes the link-time flag -rdynamic to compile steps ($(CC) -c), where it is unused. Under -Werror, Clang fails the build: $ make CC=clang-21 clang-21: error: argument unused during compilation: '-rdynamic' [-Werror,-Wunused-command-line-argument] Nothing needs the exported symbols. Separately, LDFLAGS uses '=' rather than '+=', discarding USERLDFLAGS from lib.mk. Drop -rdynamic and append LDFLAGS with '+='. This fixes builds with CC=clang-N while preserving USERLDFLAGS. v2: Drop -rdynamic instead of moving it to LDFLAGS (Tejun Heo). Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-09-08selftests/drivers/net: include lib/sh/*.shHangbin Liu
When I tried to install and run bonding selftests via: make INSTALL_PATH=/tmp/kself TARGETS=drivers/net/bonding \ -C tools/testing/selftests install Some tests fail because net/lib/sh/defer.sh is missing: /tmp/kself/net/forwarding/../lib.sh: line 5: /tmp/kself/net/lib/sh/defer.sh: No such file or directory One option is to add defer.sh directly to TEST_INCLUDES. Alternatively, follow the approach from commit f72aa1b27628 ("selftests: net: include lib/sh/*.sh with lib.sh"), which pulls in all .sh files to accommodate future changes to the library directory. This patch adds a wildcard to include all shell files for drivers/net tests that consume net lib.sh. TEST_INCLUDES is also sorted to avoid ordering‑related problems for future modifications. The team driver is not affected by this bug, but we use the wildcard for it as well, rather than listing only defer.sh. Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn> Reviewed-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Breno Leitao <leitao@debian.org> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260907-selftest_lib_defer-v1-1-8af94645aaa3@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-08selftests: drv-net: Use cross-compilation environment for the io_uring checkMaxime Chevallier (Netdev Foundation)
To test for the presence of zerocopy support in the available liburing, a small check program is compiled. The CC value used for the io_uring library check defaults to the host compiler, which will incorrectly validate liburing based on the host's sysroot and not the target's. Normally the CC for cross-compile is set in lib.mk, but this also requires the test list to be set when we include it, and this check needs to run first. Note that this doesn't cover the LLVM cross-compiling case though, as with LLVM we may still detect based on the host liburing. Suggested-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Reviewed-by: Matthieu Baerts (Netdev Foundation) <matttbe@kernel.org> Signed-off-by: Maxime Chevallier (Netdev Foundation) <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260907161438.755125-3-maxime.chevallier@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-08selftests/bpf: Test array element comparison in BTF dedupMingpei CAO
Exercise recursive array comparison with different and identical element definitions using the existing BTF dedup tests. Add a separate case with the same index type to isolate the element-type comparison. Check that distinct containers remain separate and identical types are deduplicated. Both negative cases fail before the fix and pass afterwards; the positive case passes both before and after the fix. Suggested-by: Alan Maguire <alan.maguire@oracle.com> Signed-off-by: Mingpei CAO <caomingpei@gmail.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260908164920.108074-3-caomingpei@gmail.com
2026-09-08selftests/sched_ext: Cover duplicate DSQ creation and ID reuseTianyi Chen
The create_dsq test creates and destroys queues, but does not check the -EEXIST contract for duplicate creation or whether the ID remains accessible after the failed operation. Extend the existing lifecycle loop to reject duplicate creation and check that the empty queue is still accessible. After destruction, require -ENOENT from the queue lookup, then recreate and destroy the same ID. Check that all 1024 iterations complete. This exercises empty queues during initialization, without concurrent enqueueing or destruction of a nonempty queue. The create_dsq test passes on a two-CPU matching-kernel VM. Link: https://lore.kernel.org/all/Z-OZ7tJWhRZbUk1l@gpd3/ Assisted-by: LLM Signed-off-by: Tianyi Chen <hi@tychen.cc> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-09-08selftests/sched_ext: Handle CPU hotplug write failuresTianyi Chen
toggle_online_status() logs failed CPU state changes but discards the write result. The hotplug tests can consequently wait indefinitely for a scheduler exit that the failed operation never triggered. Return the write result and stop both hotplug tests when a required CPU state change fails. Release the acquired scheduler resources on these paths and let the existing cleanup callback retry restoring CPU1. Also fail the test when its normal CPU restoration fails. Tested in a two-vCPU VM running a kernel built from the same source as the selftests. Injecting EIO with strace into each of the ten CPU state writes makes the fixed test return 1, with CPU1 online and sched_ext disabled after cleanup. The original test does not finish within three seconds when either of the first two writes fails. Normal hotplug tests pass before and after the change. Making the online file read-only also produces a failure without hanging. Fixes: a5db7817af78 ("sched_ext: Add selftests") Assisted-by: LLM Signed-off-by: Tianyi Chen <hi@tychen.cc> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-09-08selftests/sched_ext: Fail interrupted test runsTianyi Chen
SIGINT and SIGTERM set exit_req, causing the runner to stop before executing the remaining tests. However, the exit status only reflects the number of failed tests, so an interrupted run returns success when none of the completed tests failed. Include exit_req in the failure condition so callers can distinguish an interrupted run from a successful run. Keep the result counts limited to the tests that actually ran. Tested the actual runner under GDB, delivering each signal before the first test and after the example test passed. The original runner returns 0 in all four cases; the fixed runner returns 1. Normal -h, -l and -t example invocations still return 0. Fixes: 9d851afa4826 ("selftests/sched_ext: Abort test loop on signal") Assisted-by: LLM Signed-off-by: Tianyi Chen <hi@tychen.cc> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-09-08landlock: Test trace path output boundariesMickaël Salaün
Use focused KUnit tests to exercise the renderer's internal boundary and composition contracts with synthetic scratch states, including both sibling-helper evaluation orders. Check the exact output and reservation boundaries, including a four-byte octal escape accepted at exact capacity and rejected one byte short. Also verify an unchanged cursor on failure, that bracketed process names and embedded NUL bytes remain data, and that input ellipsis bytes are escaped rather than mistaken for the raw truncation marker. The composition test requires generic trace output helpers. Enable CONFIG_FTRACE and CONFIG_SCHED_TRACER because the latter selects the otherwise-hidden CONFIG_TRACING support required by trace_print_flags_seq(). Use kselftests to exercise the complete tracefs path for both affected filesystem events. A valid path containing 2640 spaces exceeds the scratch output budget. Require its escaped prefix to end in the raw UTF-8 ellipsis while access_rights and blockers remain intact. This division keeps the exact safety contract compiler-independent while proving that real tracepoints preserve their surrounding symbolic fields. The end-to-end assertions fail after a full fix revert with both GCC and Clang, while the composition KUnit test fails if the scratch reserve is removed. Cc: Günther Noack <gnoack@google.com> Link: https://patch.msgid.link/20260907154401.124362-2-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-09-07selftests/bpf: Add test for bpf_skb_change_tail on csum partial skbsDaniel Borkmann
Add a test which builds an ICMP error out of a TCP segment. A tcx prog on the client's egress side trims the first data segment down to the target size and pushes the ICMP error headers in front of it to then reflect the packet back to the sender. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t tc_change_tail [...] #509 tc_change_tail:OK #510 tc_change_tail_pmtu:OK Summary: 2/0 PASSED, 0 SKIPPED, 0/0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260907121025.1923656-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-07selftests: net: Test UDP length overflow with PMTU discover and big MTUAlice Mikityanska
Two previous commits fixed overflow of UDP length when setsockopt IP(V6)_MTU_DISCOVER is set to IPV6_PMTUDISC_DO or IP(V6)_PMTUDISC_PROBE, and a large packet is sent over a netdev with an unusually large MTU. This commit adds the selftests that replicate the described steps to reproduce for IPv6 and IPv4, and also one more test that ensures that sending UDP jumbograms over a raw socket is still possible after the fix. Signed-off-by: Alice Mikityanska <alice@isovalent.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260901195714.673548-4-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07selftest: af_unix: Add zero-buffer test for msg_oob.cKuniyuki Iwashima
The previous patches fixed two issues related to zero-length buffer with MSG_PEEK for MSG_OOB skb. Let's add corresponding tests in msg_oob.c. Without this series: # FAILED: 50 / 60 tests passed. # Totals: pass:50 fail:10 xfail:0 xpass:0 skip:0 error:0 With this series: # PASSED: 60 / 60 tests passed. # Totals: pass:60 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260902202202.892676-4-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-07selftests/landlock: Test abstract socket trace name limitsMickaël Salaün
The landlock_deny_scope_abstract_unix_socket event captures binary socket names with __string_len(), whose dynamic field reserves an extra byte for the NUL terminator. The printer subtracts this byte before escaping the content. Exercise the minimum accepted address length, which has no name content, and the maximum sockaddr_un length, which has 107 content bytes. Check the exact trace output at both boundaries. The existing stream and datagram variants share this event, so the boundary variants only need the stream path. Because these boundary names are fixed, run the fixture in a private network namespace. Abstract UNIX socket names are scoped by network namespace, preventing concurrent bind() calls from colliding. The lower-bound test confirms that the subtraction recovers zero instead of underflowing. Cc: Günther Noack <gnoack@google.com> Link: https://patch.msgid.link/CAL4aGcVcT0VWVFmGi_vLqxxZ9KdOHfGXYZtKjBdvoUyFjbu5=A@mail.gmail.com Link: https://patch.msgid.link/20260907103503.109461-1-mic@digikod.net Signed-off-by: Mickaël Salaün <mic@digikod.net>
2026-09-06Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.3-rc2Alexei Starovoitov
Cross-merge BPF and other fixes after downstream PR. Conflicts: kernel/bpf/backtrack.c include/linux/bpf_verifier.h Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-06Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull bpf fixes from Alexei Starovoitov: "This mainly contains verifier fixes that address bugs reported by Nicholas Carlini. - Fix incorrect non-NULL inference in pointer comparisons: pointer types that may be NULL at runtime, pointers with unbounded offsets, JMP32 comparisons with zero, and imprecise zero registers (Eduard Zingerman) - Fix precision tracking for half-dead zero spills, ld_abs/ld_ind implicit subprog exit, bpf_loop() callbacks, linked scalar ids and NULL call arguments (Eduard Zingerman) - Reject BPF_PSEUDO_FUNC reference to the main program, fix zero extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall patterns entered by a jump (Eduard Zingerman) - Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs (Hui Su) - Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types, and reject key-less BTF for hash maps (Jiayuan Chen) - Various fixes (Kumar Kartikeya Dwivedi): - Fix out-of-bounds access in disassembler on invalid LDSX instruction - mark siginfo of signal tracepoints as scalar and sched_process_wait argument as nullable - mark faultable stack helpers as sleepable - reject tail calls and legacy packet loads from callbacks - enforce rbtree callback lock restrictions for resilient locks - require MEM_PERCPU for percpu kptr stores - clear NON_OWN_REF after RCU protection ends - mark NULL kptr stores precise - preserve inner map identity in callback frames - reject non-scalar bpf_loop() iteration counts - Fix trampoline allocation slowdown on x86 by using EXECMEM_MODULE_DATA (Mike Rapoport) - Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and reject untrusted allocated-object pointers (Ning Ding) - Fix special fields handling in recycled rhtab elements (Nuoqi Gui, Yuan Chen)" * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits) bpf, riscv: Make arena support depend on ZACAS selftests/bpf: Test pointer bpf_loop iteration count rejection bpf: Reject non-scalar bpf_loop iteration counts bpf: use mark_arg_precision() in check_mem_size_reg() bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero() selftests/bpf: precision of a NULL global subprogram BTF_ID argument bpf: mark a NULL BTF_ID argument of a global subprogram precise selftests/bpf: precision of a NULL kfunc argument bpf: mark a NULL kfunc argument precise selftests/bpf: precision of a NULL global subprogram memory argument bpf: mark a NULL memory argument of a call precise selftests/bpf: precision of a NULL helper argument bpf: mark a NULL call argument precise selftests/bpf: Test inner map identities in callbacks bpf: Preserve inner map identity in callback frames selftests/bpf: Test imprecise scalar kptr stores bpf: Mark NULL kptr stores precise selftests/bpf: Test rhtab kptr cancellation semantics bpf: Cancel special fields when recycling rhtab elements selftests/bpf: Test timer field on recycled rhtab element ...