| Age | Commit message (Collapse) | Author |
|---|
|
Test 8c39 brings up lo with a bare "ip" command. nsPlugin runs it as
"$IP netns exec <ns> ip ...", and as tdc runs commands with an empty
environment, "ip netns exec" searches only the default execvp() path
(/bin:/usr/bin). On systems that install ip only in /sbin, like Fedora,
the setup fails:
# ./tdc.py -e 8c39
Test 8c39: HFSC classify walk still reaches leaf after lateral drift
-----> prepare stage *** Could not execute: "ip link set lo up"
-----> prepare stage *** Error message: "exec of "ip" failed: No such file or directory
Use $IP like all other tdc tests do.
Fixes: 1e24c4f2ee44 ("selftests: tc-testing: add a lateral-drift hfsc classify-walk test")
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Link: https://patch.msgid.link/20261014121414.2373985-1-ivecera@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
During conversion, we retain the same table and chain names used by the
original iptables/ip6tables setup, so rule output is identical to the
former iptables/ip6tables output. Add new function init_nftables so we
only do nft table setup when test need set nft rules.
Unlike iptables, nftables cannot match rules based on their full
specification. Since endpoint_tests is the only test that delete rules,
which inserts and deletes rules one by one. Flushing the table
directly is safe and easier than using nft_handle.
The cBPF bytecode matching MPTCP add‑addr is replaced with native nft
matching using "tcp option mptcp subtype add-addr". But the RM_ADDR
suboption is added after the MPTCP DSS option, and nft is unable to
handle this because it stops parsing further TCP options once it matches
the first one. We therefore use hard-coded offsets to match the RM_ADDR
suboption.
The config file adds CONFIG_NFT_NUMGEN (replaces iptables statistic nth),
CONFIG_NFT_REJECT and CONFIG_NFT_REJECT_INET for reject‑related rules.
Remove other unneeded configs.
Remove the iptables/ip6tables check in mptcp_lib.sh since no script use
it now.
Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-next-mptcp-misc-feat-7-4-part2-v1-4-1181e5d2fda4@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
During the conversion, we retain the same filter and chain names previously
used by iptables/ip6tables. Counters are not added to accept rules because
the test does not inspect them. The syn mark rule is removed as it is
only for debugging, which could be added easily when needed.
After conversion, the generated output matches the original
iptables/ip6tables behavior.
Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-next-mptcp-misc-feat-7-4-part2-v1-3-1181e5d2fda4@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull pidfd updates from Christian Brauner:
"This adds thread specific pidfds to af_unix sockets.
SO_PASSPIDFD and SO_PEERPIDFD hand out a pidfd for the thread-group
leader. A coredump server on the coredump socket can't get a handle on
the thread that took the signal and is writing the dump, and anything
doing per-thread authentication has the same problem. The sending and
the connecting thread are recorded in addition to the thread-group
leader and sk_peer_pid becomes an array indexed by pid type.
SO_PASSPIDFD_THREAD works like SO_PASSPIDFD but delivers an
SCM_PIDFD_THREAD cmsg for the sending thread. Both options are
independent so a receiver can ask for both. On SOCK_STREAM sockets
recvmsg() only stops merging data at a thread boundary when the
receiver asked for a thread pidfd. SO_PEERPIDFD_THREAD returns a pidfd
for the thread that called connect(), listen() or socketpair(). pidfs
records the coredump on the dumping thread's struct pid too so its
pidfd reports it like the leader's does. Selftests for af_unix and the
coredump socket are included"
* tag 'vfs-7.4-rc1.shared.net-next.pidfd' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/coredump: check the dumping thread's pidfd
pidfs: record the coredump on the dumping thread's pid too
selftests/net: SO_PEERPIDFD_THREAD
net: add SO_PEERPIDFD_THREAD to get a thread-specific pidfd
af_unix: record the pid of the connecting thread
net: turn sk_peer_pid into an array indexed by pid type
selftests/net: SO_PASSPIDFD_THREAD
net: add SO_PASSPIDFD_THREAD to get a thread-specific SCM_PIDFD
af_unix: record the pid of the sending thread
pid: add helpers to operate on a struct pid array
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull mount updates from Christian Brauner:
"This adds OPEN_TREE_DROP_MNTNS_MOUNTS.
crun started using OPEN_TREE_NAMESPACE to set up the container's mount
namespace and open_tree(OPEN_TREE_CLONE) for the sources of its bind
mounts. That fails on any host with a mount namespace pinned below
such a source. The recursive clone picks the pinned namespace up and
move_mount() refuses to attach the tree with ELOOP. Only a younger
mount namespace may ever be bound into an older one or mount namespace
references could form a loop. A namespace created with
OPEN_TREE_NAMESPACE is younger than everything else on the system so
from inside it every pinned namespace is older. By the time this fails
setns() has run and the host tree is out of reach, so the runtime has
to predict the situation beforehand and lose the optimization. snapd
pins mount namespaces under /run/snapd/ns so on Ubuntu that is any
container bind mounting the host root.
Every other path crossing a mount namespace boundary already leaves
these mounts behind, copy_mnt_ns() and create_new_namespace() both do.
Only get_detached_copy() asks for them.
The new flag lets a caller get a clone without them. It stays opt-in
because open_tree(OPEN_TREE_CLONE) plus move_mount() is mount --rbind
through a file descriptor and dropping them by default would silently
lose /run/snapd/ns/*.mnt on a live system. It requires AT_RECURSIVE,
is a no-op with OPEN_TREE_NAMESPACE and skips locked nsfs mounts the
way copy_mnt_ns() does, so nothing new is exposed. Selftests are
included"
* tag 'vfs-7.4-rc1.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/filesystems: test OPEN_TREE_DROP_MNTNS_MOUNTS
mount: add OPEN_TREE_DROP_MNTNS_MOUNTS
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull misc vfs updates from Christian Brauner:
"Fixes:
- aio: a keyed poll completion on an epoll instance could recurse
into the same epoll waitqueue lock when the result eventfd is
watched by that very instance. An unprivileged process could make a
CPU spin on the recursive lock. eventfd-backed poll completions are
always deferred now.
- fsnotify_inoderemove() is only called once the inode is really
dead, no nlink and no aliases, and open_by_handle_at() can't add an
alias to a dead inode anymore. The race could crash fsnotify or
lose inode mark notifications.
- devtmpfs: the conversion of the public instance to ->get_tree()
broke reconfiguring the shared superblock's options on later mounts
which made the boot time defaults permanent. A reconfigure context
is kept in fc->fs_private so the parse ops can forward options to
the underlying filesystem.
- ufs truncated the 64-bit directory size to an unsigned int in
ufs_last_byte(). A crafted image with a 4 GiB directory produced an
out-of-folio read in ufs_find_entry() and, with
CONFIG_UFS_FS_WRITE, a write into an adjacent page.
- devpts rejects max=0 instead of silently lifting the per-instance
pty limit. The value wrapped into ida_alloc_max() and became
unlimited.
- fs_pin publishes pins with the rcu list helpers so the kill paths
reading the lists under rcu see the initialization.
- dentry_kill() reports a Tasks-RCU quiescent state. Its
cond_resched() is the only reschedule point on the dentry teardown
path and cond_resched() isn't a quiescent state for Tasks-RCU, so
Meta kept seeing rcu_tasks stalls in btrfs subvolume deletion.
- writeback sizes foreign flushes by the target wb's dirty pages
instead of the memcg-wide count which over or undersized a single
bdi flush.
- nfsd READ emitted two fsnotify access events on the iterator path
since vfs_iocb_iter_read() already sends one. A READ on a krb5i or
krb5p mount showed up twice in inotify.
- pipe and splice pass a poll key when waking readers and writers so
epoll, poll() and select() waiters only wake for the event they
asked for.
- the iso8859-14 Unicode to charset tables had page01 duplicated as
page1e so 29 code points mapped to the wrong bytes and 22 that
aren't in the charset were accepted.
- orangefs doesn't wait for an unmount service operation that never
returns on system shutdown and uses ssize_t for strscpy() errors.
- __register_chrdev() checks the kobject_set_name() return value.
- selftest fixes: the openat2 tests hardcoded O_LARGEFILE to 0x8000
which is O_NOFOLLOW on powerpc, resolve_test makes /tmp a
mountpoint so RESOLVE_NO_XDEV has a boundary to trip over,
file_stressor moves into its own directory with a 30 minute
timeout, the kernfs listxattr test skips when SELinux exposes
security.selinux, the namespaces active reference tests wait for
the thread via a PIDFD_THREAD pidfd since pthread_join() returns
before exit_nsproxy_namespaces(), the idmapped_tmpfile test chowns
its directory into the mapped range, the clone3 CLONE_CLEAR_SIGHAND
test adds CLONE_VM so it fails for the intended reason, the pidfd
PPID error message prints the values it compares and fscontext_ns
gets a .gitignore.
Cleanups:
- vmcore prints the release of the crashed kernel from the VMCOREINFO
note so a kdump that dies before the dump lands still says which
kernel it was for.
- initramfs allocates hardlink hash entries with the validated cpio
name length instead of PATH_MAX, which put every entry in
kmalloc-8k.
- the unused dax_layout_busy_page() is removed,
dax_layout_busy_page_range() becomes static and dax_folio_init()
drops a redundant list initialization.
- vfs_empty_path() is removed, it has had no callers since
getname_maybe_null().
- comment and documentation fixes in aio, bpf_fs_kfuncs,
fs-writeback, inode, read_write, squashfs and the vfs.rst copy of
struct file_system_type"
* tag 'vfs-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (38 commits)
selftests/filesystems: Fix idmapped_tmpfile layer dir ownership
selftests/namespaces: Wait for thread exit via pidfd in active-ref tests
writeback: size foreign flushes by target wb dirty pages
initramfs: Reduce hardlink hash allocation sizes
fs: remove unused vfs_empty_path()
dcache: report a Tasks-RCU quiescent state in dentry_kill()
vmcore: report the release of the crashed kernel
splice: pass a poll key when waking pipe readers and writers
pipe: pass a poll key when waking writers after a resize
orangefs: use ssize_t instead of size_t for error codes...
orangefs_super: don't wait on service operation on system shutdown.
docs/vfs: Fix the struct file_system_type copy
nls: fix the Unicode to charset tables of iso8859-14
selftests/filesystems/openat2: make /tmp a mountpoint inside private namespace
selftests/filesystems/openat2: fix O_LARGEFILE definitions for non-arm64 architectures
fs: fix misleading comments in read_write.c
squashfs: fix inode number description in documentation
fs: fix typos in comments
fs/dax: Make dax_layout_busy_page_range() static
fs/dax: Remove unused dax_layout_busy_page()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull kernfs updates from Christian Brauner:
"This contains kernfs scalability work from Shakeel driven by what Meta
sees in their fleet. kernfs_rwsem is per kernfs root, so sysfs and
cgroupfs each have one for the whole machine, and every create, remove
and rename takes it for writing. rwsems don't let readers steal the
lock once a writer is queued, so one cgroup being created or a device
being renamed parks the entire incoming reader stream in
uninterruptible sleep. Daemons that poll cgroup files in a loop turn
that into a convoy and the two that hurt most, oomd and below, are the
ones that are supposed to relieve memory pressure and record what
happened.
kernfs_dop_revalidate() took kernfs_rwsem for read once per path
component of every walk into a kernfs mount. Nothing it reads needs
the semaphore. kn->active is an atomic_t, kn->__parent and kn->name
are rcu pointers, kn->ns can be compared instead of dereferenced and
the directory revision is a plain counter. The callback runs under rcu
now. Readers walking cgroupfs and sysfs while another thread churns
cgroups, renames netdevs and plugs devices went from 48,593,360 read
acquisitions and 1,744,517 contentions to 1,280,280 and 429,846 on an
8-CPU VM and path walk throughput improved 35-53%. LOOKUP_RCU still
returns ECHILD because kernfs_iop_permission() forces every walk out
of rcu-walk anyway. That is left for later.
kernfs_fop_readdir() held the semaphore across dir_emit(). dir_emit()
copies to userspace and under memory pressure that fault goes to
reclaim with the lock every create, remove and rename needs held for
reading. Meta sees 120 second allocation stalls in filldir64() from
below and systemd-oomd stuck behind it. The lock is dropped around
dir_emit() now. Since the entry the listing stopped on can disappear
in that window and two entries can share a hash, readdir resumes on
the full (hash, ns, name) key and the fallback search lands after the
missing entry instead of repeating or skipping one. The repeat was a
pre-existing bug between two getdents(2) calls.
Three more lock holds are shortened. kernfs_notify_workfn() no longer
holds kernfs_rwsem across fsnotify() which allocates against the memcg
of the watching cgroup that is already under pressure. The open node
is allocated outside the hashed open file mutex, the most contended
lock in kernfs on their fleet with 2.19M waiters over 29 days and a
77ms median hold. A new node is activated without dropping and
retaking the write lock, lock_stat says 1200 -> 830 write acquisitions
for five dummy netdevs, and kernfs_rename_ns() allocates the new name
before and frees the old one after the lock so a rename can't enter
reclaim or wait out a grace period with it held.
Three standalone fixes come with selftests. Same-parent renames take
kernfs_rename_lock too so kernfs_path_from_node() can't build a path
that never existed. Decoding a file handle takes the semaphore so a
decode racing rmdir() can't hash an inode after the removal's
ilookup() pass and lose IN_DELETE_SELF. And kernfs_create_link() reads
the target's uid and gid under kernfs_iattr_rwsem so a chown in
between can't give the link an owner the target never had. The kernfs
selftests grew from two xattr checks to coverage of dentry
revalidation, rename, namespace tagging, file handles and readdir
under churn"
* tag 'vfs-7.4-rc1.kernfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
kernfs: free the old name outside kernfs_rwsem
kernfs: allocate the new name outside kernfs_rwsem
kernfs: activate a new node without dropping kernfs_rwsem
selftests: cover readdir resuming at a removed entry
kernfs: don't hold kernfs_rwsem across dir_emit()
kernfs: resume readdir on the full entry key
kernfs: don't repeat or skip an entry when readdir resumes
kernfs: don't hold kernfs_rwsem across notification delivery
kernfs: allocate the open node outside the open file mutex
kernfs: fix up the unlocked attribute reads on the creation paths
kernfs: don't lose IN_DELETE_SELF when decoding a file handle
kernfs: take kernfs_rename_lock for same-parent renames too
selftests: cover kernfs file handles and same-parent rename
selftests: cover kernfs dentry revalidation
kernfs: Remove kernfs_rwsem from dentry revalidation
kernfs: Avoid namespace dereference in d_revalidate()
kernfs: Prepare directory revisions for lockless reads
kernfs: Use VFS lookup context in d_revalidate()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull coredump updates from Christian Brauner:
"This adds sparse coredumps and per-request memory type selection to
the coredump socket protocol.
A coredump sent over the socket transfers every zero of every hole in
every mapping. For a process with 128 threads that's 1 GB of mostly
thread stacks, 8 MB reservations with a few pages touched, and the
holes sit in the middle of the dump rather than at the end. The
coredump_filter bit that was proposed for this stops each PT_LOAD at
the last populated page. But that mask says which kinds of memory to
include and propagates across fork and exec, whereas what is selected
here is an encoding. The usermodehelper isn't salvagable for this
either. The coredump socket already has a handshake for exactly this.
A server that raises COREDUMP_RECORDS in coredump_ack->mask gets the
coredump as a sequence of records, each a struct
coredump_record_header followed by what it describes. The stream ends
explicitly with an end record that reports the size, so a missing one
means truncation.
With COREDUMP_SPARSE holes cross the socket as a bare header that says
how many zero bytes were skipped. Reassembling the records gives back
the same coredump, so a debugger and everything else still see an
ordinary core file. Numbers from the selftests: the 128 thread process
sends 1424153 bytes for a coredump of 1075150848 bytes, a 256 MB
mapping with the first and the last page touched sends 188793 bytes
for 268890112 bytes, and with COREDUMP_RECORDS alone the record
overhead is under one percent.
The selftests also simulate a server uploading to a blob store that
can't seek and rewrites the program headers so the object is an
ordinary ELF core file without the holes.
COREDUMP_MEMORY_TYPES lets the server choose what memory to dump per
request instead of relying on the static /proc/<pid>/coredump_filter
of the crashing task. The request carries the default types and a mask
of every type the kernel knows about, the ack carries the selection.
Zero is valid and dumps the program headers and notes and nothing but
the mappings that are always dumped.
Preparatory cleanups refuse negative skips in dump_skip_to(), chunk
every write at a page so a pipe or a socket never takes a short write
in the middle of a record, make the dump helpers return bool and
replace the core_dumped integer with COREDUMP_STATE_STARTED and
COREDUMP_STATE_TRUNCATED flags.
Also included is a fix for coredump_parse() reading core_pattern while
it is being modified. The sysctl handler now validates a copy and
publishes it under a spinlock and the parser works on a snapshot, so a
rejected pattern is never visible and the rollback logic goes away.
And to_kthread()'s lockless flags read is annotated with READ_ONCE()"
* tag 'vfs-7.4-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (29 commits)
kthread: Annotate lockless to_kthread() flags access
coredump: parse a snapshot of core_pattern
selftests/coredump: test failed handshakes
selftests/coredump: improve coredump size negotiation tests
selftests/coredump: test COREDUMP_MEMORY_TYPES
selftests/coredump: simplify the refusal tests
tools: sync coredump.h header
coredump: select memory types to include
selftests/coredump: show how to inspect the task to decide how the coredump should be sent
selftests/coredump: simulate a blob store
selftests/coredump: put a hole in the middle of a sparse mapping
selftests/coredump: hand the record stream to a sink
selftests/coredump: test COREDUMP_RECORDS and COREDUMP_SPARSE
coredump: describe the holes when COREDUMP_SPARSE is negotiated
coredump: send the coredump in records if requested
tools: sync coredump.h header
coredump: add COREDUMP_SPARSE to the coredump socket protocol
coredump: add COREDUMP_RECORDS to the coredump socket protocol
coredump: clean up coredump state handling
coredump: always chunk writes
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull close_range updates from Christian Brauner:
"This adds two new close_range() flags.
CLOSE_RANGE_EXCEPT makes close_range() operate on all file descriptors
outside of [fd, max_fd] instead of the ones inside. Alone it closes
everything but the range. With CLOSE_RANGE_CLOEXEC it marks everything
but the range close-on-exec. With CLOSE_RANGE_UNSHARE dup_fd() never
takes a reference on what is dropped. So a task between
clone(CLONE_FILES | CLONE_VM | CLONE_VFORK) and execve() that has the
descriptors for the child in one window can shed the rest of the
shared table in one call and nothing outside of the window is
referenced by the child at any point.
CLOSE_RANGE_CLOEXEC_ONLY closes the close-on-exec descriptors in the
range and leaves everything else alone. Whatever the caller
deliberately passes down, stdio, LISTEN_FDS, an inherited pipe, stays
where it is. Combined with CLOSE_RANGE_EXCEPT it names the handful of
close-on-exec descriptors that have to survive, the executable or an
error pipe, and closes every other close-on-exec descriptor.
Along the way dup_fd() stops copying a range in the middle of the
table only to close it again. close_range(CLOSE_RANGE_UNSHARE) only
avoided the copy when the range sat at the end of the table.
Descriptors in a skipped range are never copied and no reference is
taken on them, so ->flush() isn't called anymore for files from a
table they were never part of. The flags are turned into an enum and
selftests cover the window positions, the shared and the private table
and the unshare form"
* tag 'vfs-7.4-rc1.close_range' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/core: test CLOSE_RANGE_CLOEXEC_ONLY
file: add CLOSE_RANGE_CLOEXEC_ONLY
file: let dup_fd() drop only close-on-exec descriptors
selftests/core: test CLOSE_RANGE_EXCEPT
file: add CLOSE_RANGE_EXCEPT
close_range: turn the flags into an enum
file: let dup_fd() drop everything outside of the range
file: rename dup_fd()'s punch_hole to range
selftests/core: test the hole CLOSE_RANGE_UNSHARE leaves behind
file: let dup_fd() leave the punched hole behind
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull binfmt updates from Christian Brauner:
"This only lets punctuation delimit a binfmt_misc register string.
Arbitrary delimiters never made sense and nothing uses them. Every new
flag shrank the set of possible delimiters and made extensions more
hazardous than they need to be. Letters, digits, whitespace, control
characters, bytes above 0x7f and the backslash now get EINVAL.
Everything deployed uses ':' anyway. This extends the fix that
rejected a flag character as the delimiter.
Selftests and documentation are included"
* tag 'vfs-7.4-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
binfmt_misc: document the field delimiter
selftests/exec: test delimiter restrictions
binfmt_misc: only let punctuation delimit a register string
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull bfs removal from Christian Brauner:
"This removes bfs, the filesystem UnixWare uses for its boot partition.
It only supports contiguous files and has no subdirectories. The only
data on such a partition are kernels and bootloader settings so there
is no reason to access it from Linux anymore. The uapi header stays"
* tag 'vfs-7.4-rc1.bfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
bfs: remove the filesystem
|
|
tca_action_gd() takes one reference per nested TCA_ACT_TAB entry while
tcf_action_delete() consumes two per slot, so three duplicate
TCA_ACT_INDEX entries in one RTM_DELACTION free the action mid-walk and
the next slot dereferences it. Assert a duplicate batch is rejected and
the action survives.
Conditions to recreate the bug:
tc actions add action pass index 1
tc actions delete action gact index 1 action gact index 1 \
action gact index 1
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/QDISC-K1TH.v1.r3.20261012134653-2@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull signal handling updates from Christian Brauner:
"This stops TIF_NOTIFY_SIGNAL from interrupting work that can't be
restarted and fixes a bunch of coredump and signal bugs.
TIF_NOTIFY_SIGNAL kicks a task out of an uninterruptible sleep so it
returns to userspace, runs its task work and goes back to sleep. That
breaks coredumps: dump_interrupted() only lets fatal signals interrupt
a dump and writes to a regular file ignore TIF_NOTIFY_SIGNAL. But the
pipe and the socket paths check signal_pending() Adeep down in code
that is shared with regular syscalls and bail. So a crashing process
with io_uring requests in flight loses most of its coredump.
In the selftest an unfixed kernel delivers 357324 of at least 5111808
bytes. And io_uring isn't the only source. klp_send_signals(),
bpf_task_work_schedule_signal(), landlock's tsync, kthread_stop() and
the printk kunit test raise the bit as well, some of them from irq
context against any task. So this can't be fixed per subsystem and the
state has to be per-task and ambient.
Add PF_NO_NOTIFY_SIGNAL and no_notify_signal_save()/restore() helpers
modelled on memalloc_nofs_save(). Inside such a section
signal_pending() ignores TIF_NOTIFY_SIGNAL. Coredumps, the smb send
path, which hand-rolled its own version of this, and the pid namespace
reaper, which busy-looped when the bit kept getting raised, are
converted.
The second part is a set of fixes that fell out of looking at the
coredump code with kres and modelling it in TLA+:
- coredump_finish() woke the parked threads without holding rcu. A
parked thread can exit on a spurious wakeup and be freed before
wake_up_process() takes its pi_lock.
- Only SIGKILL and the freezers interrupt a dump now and the three
freezers agree. Power management and cgroup v1 freezing aborted a
dump while a cgroup v2 freeze either waited for the dump or cut it
short depending on where the core went.
- io-wq set its exit bit without a barrier against the task work that
creates workers. On weakly ordered architectures exit could hang on
worker_done.
- retarget_shared_pending() slingshotted a shared signal to the dumper
when a zapped sibling restored its signal mask. That set
TIF_SIGPENDING on the dumper and truncated the core.
- A tracer could clear the signal mask of a user worker with
PTRACE_SETSIGMASK and inject a coredump signal. An io-wq worker of
an SQPOLL ring dumping core deadlocks the whole group.
PTRACE_SETSIGMASK is refused for user workers now and
__set_task_blocked() enforces the fork-time mask.
- exec cancels io_uring requests before de_thread() so a worker
creation queued as task work can't add a thread to a thread group
that de_thread() just took down.
- No io threads are created from a PF_SIGNALED or PF_POSTCOREDUMP
creator anymore. Such a worker was invisible to zap_process() but
still decremented threads_remaining on exit so the dumper could
leave coredump_wait_inactive() early.
Also included are a comment that do_each_pid_task() needs
tasklist_lock, a READ_ONCE() in pid_alive() and a regression test for
fork() into a pid namespace whose ancestor lost its init"
* tag 'kernel-7.4-rc1.signal' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (21 commits)
pid: use READ_ONCE() in pid_alive()
selftests: pid_namespace: test fork with dead ancestor
pid: document that do_each_pid_task() needs tasklist_lock
signal: enforce the user worker signal mask in __set_task_blocked()
fork: use SIG_KERNEL_ONLY_MASK for the user worker signal mask
fork: don't create io threads once PF_POSTCOREDUMP is set
fork: move the coredump and exec checks into create_io_thread()
exec: cancel io_uring requests before de_thread()
selftests/coredump: expect PTRACE_SETSIGMASK to be refused on a user worker
selftests/coredump: test a user worker as the coredumping thread
ptrace: refuse to change the signal mask of a user worker
selftests/coredump: test shared signal retargeting during a dump
signal: only SIGKILL and the freezers interrupt a coredumping task
signal: don't retarget shared signals in a dying thread group
io-wq: order the exit bit against worker creation task work
coredump: hold RCU while releasing parked threads
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
smb: prevent TIF_NOTIFY_SIGNAL from interrupting
selftests/coredump: test that TIF_NOTIFY_SIGNAL doesn't truncate a coredump
coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
...
|
|
Antonio Quartulli says:
====================
Included changes:
* add Ralf Lici as ovpn reviewer
* wait for the server-side key setup before generating TCP traffic in
selftests
* enable TCP_NODELAY on TCP sockets in selftests
* drop redundant peer NULL checks in the crypto post functions
* remove the unused work field from struct ovpn_socket
* fix the documented return value of ovpn_bind_from_sockaddr()
* tag 'ovpn-net-next-20261012' of https://github.com/OpenVPN/ovpn-net-next:
MAINTAINERS: ovpn: add Ralf Lici as reviewer
selftests: ovpn: wait for the TCP server key setup before traffic
selftests: ovpn: enable TCP_NODELAY on TCP sockets
ovpn: remove redundant peer NULL checks in crypto post functions
ovpn: remove unused work field from struct ovpn_socket
ovpn: Fix the return value in ovpn_bind_from_sockaddr() kernel-doc
====================
Link: https://patch.msgid.link/
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
CKI reports sporadic failures in icmp.sh, Davide suggests this might be
caused by a race condition where tcpdump starts capturing after the last of
expected ICMP unreachable packets have been sent.
Fix this replacing tcpdump with a tc flower filter that
matches ICMP Destination Unreachable (type 3, code 0),
and match on act_gact counters instead.
This will remove any race condition to appear.
Suggested-by: Davide Caratti <dcaratti@redhat.com>
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: Prasenjit Mukherjee <pmukherj@redhat.com>
Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>
Reviewed-by: Antoine Tenart <atenart@kernel.org>
Link: https://patch.msgid.link/b15ee681a330f9b05a9076a3852c186017f59d83.1791804421.git.pmukherj@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull namespace updates from Christian Brauner:
- Reject uid_map, gid_map and projid_map values that don't fit in a
u32.
map_write() parsed with simple_strtoul() and truncated modulo 2^32 on
64-bit so "4294967301 1000 1" was installed as "5 1000 1" without an
error. Each field is parsed with kstrtou32() now and selftests cover
the out-of-range, negative and in-range cases. This isn't a security
fix. The truncated values were valid ids and every later check still
applied to them.
- Annotate struct uid_gid_map's forward and reverse pointers with
__counted_by_ptr and add a KUnit suite for inserting and sorting
extents.
insert_extent() wrote to forward[nr_extents] before bumping the count
which the annotation flags, so it bumps first now. Two follow-up
fixes rename the now global helpers to uid_gid_map_insert_extent()
and uid_gid_map_sort(), since the btrfs self-tests have their own
insert_extent(), and guard the declarations on CONFIG_KUNIT.
- Drop the BUG_ON() NULL checks in copy_mnt_ns() and copy_utsname().
create_new_namespaces() always passes a valid pointer and the other
copy_*_ns() helpers don't check either.
- Remove a dead key_put() on the create_user_ns() error path.
* tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/namespaces: add uid_map/gid_map range tests
userns: reject uid_map/gid_map values that do not fit in u32
userns: declare the KUnit-visible helpers whenever KUnit is enabled
userns: rename insert_extent() and sort_idmaps()
userns: Add KUnit test suite for uid_gid_map
userns: Add __counted_by_ptr attribute to struct uid_gid_map
fs: namespace: drop BUG_ON() in copy_mnt_ns()
uts: drop BUG_ON() in copy_utsname()
userns: remove dead key_put() on the create_user_ns() error path
|
|
The issue:
bpf_offload.py only exercises per-device ingress qdiscs today, so neither
the shared-block accept path nor the late-join replay is tested.
The Fix:
Add a test for a device-bound SCHED_CLS program attached through a shared
block. It loads a dev-bound SCHED_CLS program for a netdevsim device and
checks:
- the program attaches to a shared block owned by its device, and the
filter teardown leaves the device unloaded;
- a block that also holds an independently backed device rejects the
attach, because the offload path broadcasts the program to all
members;
- an independently backed device that joins a populated block is not
loaded by the bind/replay path, and the driver's extack is asserted;
- a second port of the same netdevsim device (same offload device) is
accepted together with the bound port.
The program is loaded from the existing sample_ret0.bpf.o with an explicit
`type classifier` override, so no new sample object is needed.
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/QDISC-PYC7.v2.20261010165947-4@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Add selftests for races between arena frees, reallocation and user
faults:
- realloc_during_free, realloc_during_deferred_free: a synchronous
or deferred free keeps its range allocated until it completes.
- fault_free_realloc: user and BPF views of a page stay coherent
while it is repeatedly faulted, freed and reallocated.
Pause frees in zap_vma_range(), after the range's kernel mappings are
gone. Unlike flush_tlb_kernel_range(), which is inline on arm64, it is
generic MM code that fentry can attach to. Map the page into user space
first, so that the free has to zap it. Print why a subtest is skipped
when a tracing target is missing. The reader in fault_free_realloc skips
reads that raise SIGBUS, which a fault on a page that is being freed
does.
Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019201108.4552-4-emil@etsalapatis.com
|
|
Load a two insn program with a junk signature and one CO-RE relocation
record, and check that the kernel refuses it with -EACCES and the message
naming the relocations, before it examines the signature. Without the
check the same load gets as far as the signature and fails on it with
-EBADMSG.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://patch.msgid.link/20261019144851.4052056-3-memxor@gmail.com
|
|
wakeup capable RTC
This test puts a system into suspend state and uses CLOCK_BOOTTIME_ALARM
to wake the system up. This alarm can only wake up systems that have a
wakeup capable RTC source. On systems without such an RTC (for example,
most RISC-V boards), this test puts the system into suspend and just
hangs, requiring power cycling.
clock_getres(CLOCK_BOOTTIME_ALARM) fails with EINVAL on such systems,
so add a check based on that to skip this test on systems without a
wakeup capable RTC source.
Link: https://lore.kernel.org/r/20261002-breakpoints_rtc-v1-1-a3b6542a0fdf@oss.tenstorrent.com
Signed-off-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
|
|
Add two tests for cgroup.kill and a process whose thread group leader
has exited while another thread is still running:
- test_cgkill_exited_leader kills the cgroup the process is in;
- test_cgkill_exited_leader_migrated moves the remaining thread to
another cgroup, where the process is not listed in cgroup.procs, and
kills that cgroup.
Both check that the cgroup is no longer populated afterwards.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
The test_cpuset_prs.sh test assumes that all the relevant CPUs being
tested are online. If some of them are offline, some of the test cases
may fail. So skip the test if the required CPUs are either offline or
not present.
While at it, the cleanup() and online_cpus() functions as well as the
trap statement to run cleanup() on exit are moved earlier to make sure
the cleanup function will be run if the test is somehow aborted early.
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
When a boot time nohz_full CPUs are present and they cover CPUs 0-7,
some of the test cases may fail. So the test run will be skipped with
a warning message in this case. On the other hand, if the boot time
nohz_full CPUs cover all the CPUs except 0-7, a special set of nohz_full
specific housekeeping check related tests could be run to make sure the
housekeeping check are behaving properly. The test_cpuset_prs.sh test
script is now updated to do exactly that.
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
Whenever a partition is enabled or the cpumask of a valid partition
changes, a housekeeping check will be performed to ensure that the
change won't violate the imposed housekeeping constraints. One of the
constraints is that a boot-time isolated CPU will not be used to form
a non-isolated root partition. This requires the presence of boot-time
isolated CPUs when a test is run.
The test_cpuset_prs.sh test script is now updated to run a set a
special housekeeping check tests that will only be run if a suitable
boot-time isolated CPU is present. This will enable us to detect bugs
or regressions in the housekeeping checking code though a "isolcpus="
boot parameter with CPUs beyond CPU 8 must be present.
This patch also includes a minor fix to the REMOTE_TEST_MATRIX to avoid
test failure when the -v option is used.
Reviewed-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
Although it is not typical for real users to create a complicated nested
partition hierarchy, it is currently allowed to create nested root and
isolated partitions. In addition, disabling or invalidating a partition
should always be allowed especially when the cpuset is being deleted.
With a nested root and isolated partition hierarchy, it is possible
that all active housekeeping CPUs can be exhausted when disabling or
invalidating a root partition and returning its CPUs to the isolated
parent.
One way to avoid this problem is to disallow the creation of a root
partition under an isolated parent. It is indeed a new limitation imposed
on the existing cpuset partition functionality. However an isolated
partition is usually a left node where scheduling and some other kernel
noises are disabled. It doesn't make much sense to create a child root
partition under an isolated parent and remove some CPUs from the set
of isolated CPUs again. Creation of a child isolated partition under a
root or isolated parent is still allowed.
If a partition with child root partitions is converted to isolated,
the child root partitions will be invalidated.
The cgroup-v2 documentation is also updated to reflect this new
limitation. New test cases are added to test_cpuset_prs.sh to verify
this new behavior. Some existing test cases are also updated accordingly.
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
It is found that when a local isolated partition is being invalidated
because its parent partition is no longer valid, the isolated_cpus
cpumask may not be properly updated. Those isolated CPUs may or may
not needed to be removed from isolated_cpus depending on if there is
a local isolated partition ancestor that will now own those isolated
CPUs instead.
Fix that by calling a new ancestor_partition() helper to return the
closeset valid partition root ancestor. If that ancestor is PRS_ROOT,
the isolated CPUs will have to be removed from isolated_cpus. For
a PRS_ISOLATED ancestor, the isolated CPUs are checked against
the ancestor's ones to see if any of them should be removed as it is
possible that the invalidation of the parent may be caused by change in
the effective xcpus of that ancestor. If any of the isolated CPUs should
be removed, isolated_cpus_update() will be called under callback_lock.
An existing test case in test_cpuset_prs.sh is modifed and a new one
added to test that.
Fixes: 11e5f407b64a ("cgroup/cpuset: Keep track of CPUs in isolated partitions")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
Use the proper framework call to mark a test as skipped. Currently, the
test is considered good, only the printout mentions the skip.
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://patch.msgid.link/20260916213108.9234-8-wsa+renesas@sang-engineering.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Use the proper framework call to mark a test as skipped. Currently, the
test is considered good, only the printout mentions the skip.
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://patch.msgid.link/20260916213108.9234-7-wsa+renesas@sang-engineering.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
The framework already annotates that we are skipping something. No need
to do in the tests themselves again.
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://patch.msgid.link/20260916213108.9234-6-wsa+renesas@sang-engineering.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
The test case rtc.date_read_loop in rtctest.c fails intermittently because
it checks that the RTC time does not advance by more than 1 second per loop
iteration. However, the loop sleeps for 11ms via nanosleep(), and if the
test thread is descheduled by the OS scheduler (e.g., under heavy system
load in a VM), more than 1 second can elapse between consecutive RTC reads.
This causes the next RTC time read to be 2 or more seconds ahead of the
previous read, triggering a test assertion failure.
To make the test more resilient against OS scheduling delays, measure the
real elapsed time between iterations using a monotonic clock
(clock_gettime(CLOCK_MONOTONIC)), and compute the actual number of seconds
elapsed (delta_s) between consecutive RTC reads. Then dynamically adjust
the assertion to:
ASSERT_GE(prev_rtc_read + delta_s + 1, rtc_read);
Signed-off-by: Wake Liu <wakel@google.com>
Link: https://patch.msgid.link/20260929152212.2092062-1-wakel@google.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
|
|
Call a kfunc with an __arena argument from a global subprogram that does
nothing else with the arena, the address arrives as a number and no cast
is involved. The subprogram needs the arena base set up by its own
prologue for the JIT to rebase the argument, which the BPF CI review
found was not recorded for it.
Pass a NULL constant to a nullable __arena kfunc argument as well, from
a program that touches the arena nowhere else. The verifier takes its
early exit for a NULL argument, but the JIT rebases the call like any
other, behind the NULL test the function model asks for, so the arena
base has to be set up for that call alone.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019132203.3034698-17-memxor@gmail.com
|
|
Add an arena-tagged pointer member to the type tag dump test and expect
the address space attribute in front of the tag. The struct_ops test
that mirrors the previous rendering now describes it as the output of
an older libbpf.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019132203.3034698-16-memxor@gmail.com
|
|
Attach a struct_ops callback with an __arena argument from an object
whose callback and unrelated program never refer to the arena, drive it
through the kernel, and check that an unrelated program of the object
got the arena among its maps as well. Load the same object through
bpf_object__prepare() and bpf_program__clone() too, the way veristat
loads programs.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019132203.3034698-13-memxor@gmail.com
|
|
Two programs expect to fail for want of an arena while living next to
an arena map: the kfunc argument case in arena_kfunc.c and the scalar
access case in verifier_arena_scalar.c. Once libbpf binds the arena of
an object to every program in it, they would load. Move them to an
object without an arena map ahead of that change, where the kernel
checks still apply, so that the tests pass at every step.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019132203.3034698-11-memxor@gmail.com
|
|
Add a struct_ops member to bpf_testmod whose argument struct publishes
arena pointers: a plain one, a __nullable one that is left NULL, one
behind a nested struct, one inside a union, next to a scalar, together
with a kfunc that fills the struct with the kernel address of an __arena
argument and calls the member.
Two callbacks read the pointers back. One shares the header with the
module, so the members are arena pointers on the program side as well
and need no cast; it also records the register a load produces, which
must be the arena offset with the upper 32 bits clear, reads the member
with a load-acquire as well, which has to yield the same pointer, and
hands the pointer to an __arena kfunc. The other mirrors the vmlinux.h
rendering of the struct, a kernel pointer with the type tag as an
attribute, and casts the members to the arena address space the way a
program built against vmlinux.h has to. Both increment the value through
each pointer and the trigger checks the count. The first callback also
reads a member through a plain pointer to a bad address, a probed load
that is skipped or faults, and checks that it reads as NULL rather than
as an arena pointer.
The failure cases cover a store to the member, which a struct_ops
program cannot do to any argument member, a load from the union, an
exchange, one insn loading the arena pointer on one path and a scalar or
a memory pointer on another, and a program without an arena. On a
kernel whose module BTF carries no type tags the member tests are
reported as skipped.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019132203.3034698-10-memxor@gmail.com
|
|
Add a struct_ops member to bpf_testmod whose argument struct carries two
task pointers, one plain and one __nullable, both made trusted through a
__safe_trusted alias of the struct in the module BTF, and a kfunc that
calls the member once with the nullable pointer unset and once set.
The callback acquires the plain pointer as is and the nullable one only
after a check, driven through the kfunc from a syscall program. The
failure case passes the nullable pointer to bpf_task_acquire() unchecked
and is rejected as possibly NULL.
More members cover the other kinds of pointer: a per-CPU one, which
only the per-CPU helpers consume and which keeps the flag, the struct
itself through a plain pointer and through an untrusted one out of a
__kptr_untrusted map value that is never set, and a pointer to a scalar,
which are probed and lose it. The callback uses each after a check; a
failure test passes the per-CPU pointer unchecked, and three programs
read the probed ones unchecked and load. bpf_testmod_ops3 gets the base
helpers for the per-CPU helpers.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019132203.3034698-9-memxor@gmail.com
|
|
Prepare an object whose program calls a kfunc of bpf_testmod and load
the program through bpf_program__clone(), the way veristat loads
programs. The module BTF fd sits in slot 1 of the fd_array of the
object and slot 0 is empty; the clone used to pass the fill index of
that array as fd_array_cnt, which made the kernel resolve slot 0 and
fail the load with "fd 0 is not pointing to valid bpf_map or btf".
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019132203.3034698-5-memxor@gmail.com
|
|
Load the exclusive program of map_excl with the map in a continuous
fd_array rather than through its insns alone, which has to work, and
the other program the same way, which has to be refused. The two
programs used to be identical and so shared a digest; give the second
one a value of its own so that the kernel can tell them apart.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261019132203.3034698-3-memxor@gmail.com
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD
KVM: s390: Changes for 7.4
- rework page allocation for secure guest variable storage
- selftests
- documentation
- replace get_zeroed_page with kzalloc
- fix floating interrupt inject for corner cases
- initial arm64 on s390 support
This also contains the patch
"arm64: Use proper include variant"
as a build fix. It is also part of the arm tree.
|
|
Drop the redundant __description macros from arena_zero_off and
cast_to_user inside jit_insns_arena. This allows the test_loader
framework to automatically fallback to the snake_case C function
names rather than the description string for test display.
Before:
$ sudo ./test_progs -t jit_insns/arena_zero_off | tail -3
#191/1 jit_insns/arena access with zero offset:FAIL
#191 jit_insns:FAIL
Summary: 1/0 PASSED, 0 SKIPPED, 1/1 FAILED
$ sudo ./test_progs -t jit_insns/cast_to_user
#191/2 jit_insns/cast to a user address:OK
#191 jit_insns:OK
#192 jit_insns_blinded:OK
Summary: 2/1 PASSED, 0 SKIPPED, 0/0 FAILED
After:
$ sudo ./test_progs -t jit_insns/arena_zero_off | tail -3
#191/1 jit_insns/arena_zero_off:FAIL
#191 jit_insns:FAIL
Summary: 1/0 PASSED, 0 SKIPPED, 1/1 FAILED
$ sudo ./test_progs -t jit_insns/cast_to_user
#191/2 jit_insns/cast_to_user:OK
#191 jit_insns:OK
#192 jit_insns_blinded:OK
Summary: 2/1 PASSED, 0 SKIPPED, 0/0 FAILED
The main goal is that if a test fails, developers can immediately
recognize the exact, actionable test name from the standard output
and rerun it without any confusion.
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20261019083005.12236-1-yangtiezhu@loongson.cn
|
|
Pull 7.4 merge-window stuff.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
|
verify_success() attaches each cpumask test program to task_newtask,
forks a single child, and expects err to be 0 afterwards. Most programs
return right away for other tasks than the test one.
test_insert_leave and test_insert_remove_release don't, and insert a
cpumask into the single entry of __cpumask_map for every task created
in the system while they are attached. test_insert_leave leaves its
cpumask in the map, so a second task created, for instance by a test
running in parallel, fails to insert one and sets err to 3. Two tasks
created at the same time can do the same to test_insert_remove_release.
Return early for other tasks than the test one in both programs, as the
other programs do.
Fixes: 7b6abcfa15cd ("selftests/bpf: Add selftest suite for cpumask kfuncs")
Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>
Link: https://lore.kernel.org/bpf/20261009-selftests-bpf-cpumask-insert-filter-v1-1-3249218594d7@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
|
|
Extend verifier_global_ptr_args.c with calls that pass bare and
RCU-protected task pointers to a global __arg_trusted parameter. Both
calls must be rejected because neither pointer is referenced or trusted.
Add paired test-module kfuncs that return and accept a nullable trusted
task pointer. Passing the return value directly must succeed, covering
PTR_TRUSTED | PTR_MAYBE_NULL handling in the common argument checker.
Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/bpf/20261007-a3-arg-trusted-v4-v4-2-253ef3a1a69a@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
|
|
bpf_proactive_reclaim() performs one bounded reclaim pass per call and,
unlike a write to memory.reclaim, does not retry until the goal is
reached.
Charge 32 MiB of page cache to a cgroup, ask for all of it in one call,
and check that the result is positive but well below the request: one
pass is capped at MEMCG_CHARGE_BATCH pages, far short of 32 MiB on both
4K and 64K page kernels.
The test deliberately covers only the kfunc itself. A full example of
the intended asynchronous use, where a BPF program watches one cgroup's
workingset refaults and reclaims another one from bpf_wq callbacks, is
maintained out of tree at [1], released under GPLv2.
Add CONFIG_MEMCG to the config fragment, without which mm/bpf_memcontrol.c
is not built at all.
[1] https://github.com/teawater/memcg-async-reclaim
Signed-off-by: Hui Zhu <zhuhui@kylinos.cn>
Reviewed-by: Barry Song <baohua@kernel.org>
Link: https://lore.kernel.org/bpf/20261009062637.176005-1-hui.zhu@linux.dev
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
|
|
All possible combinations of (BPF_EXIST, BPF_NOEXIST) and
(BPF_F_ALL_CPUS, BPF_F_CPU) flags are covered for all percpu map types.
As BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE does not support BPF_NOEXIST and
also in order to reduce the amount of code duplicates, I added its
new test scenarios to the existing cpu_flag_percpu_cgroup_storage test.
But for other percpu map types, I added new tests to be able to
exercise all flag combinations and the edge cases such as percpu LRU
unnecessary deletion issue.
Signed-off-by: Masoud Aghasi <maghasi@disroot.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://patch.msgid.link/20261008120734.1565972-4-maghasi@disroot.org
|
|
child_func() terminates with exit(), but spawn_child_flag() also starts
it via clone(CLONE_VM), which shares the parent's address space. That
exit() then runs atexit handlers and static destructors against globals
the parent is still using.
LLVM commit `3c3ed59c6a2a ("[llvm] Add format check for
MCSubtargetFeatures")` [1], included in the LLVM 23.1 releases, added
Target::isValidFeatureListFormat() with a function-local static holding
the compiled regex:
static const llvm::Regex pattern("^([+-][^,]+)(,[+-][^,]+)*,?$");
return pattern.match(Features);
The child exit destroys that static while its guard variable still marks
it as initialized, so the regex is never rebuilt in the parent. From that
point on, get_jited_program_text() gets NULL from
LLVMCreateDisasmCPUFeatures(), so every jited program text check in the
tests running after filter_clone_vm fails, e.g. "verifier_jit_convergence",
"verifier_private_stack", "verifier_tailcall_jit" and "verifier_jit_inline".
Use _exit(), which runs neither atexit handlers nor static destructors, as
uprobe_syscall.c already does for its own CLONE_VM child.
[1] https://github.com/llvm/llvm-project/pull/180943
Fixes: d2520bdb1932f ("selftests/bpf: Add uprobe multi pid filter test for clone-ed processes")
Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261018005348.2195130-5-kafai.wan@linux.dev
|
|
Commit f414d20879ae ("bpf: Save DFS postorder numbers for program
instructions") changed bpf_compute_postorder() to use a real DFS, which
changes the postorder of this test's instructions and thus the insn edge
the arg track join at insn 10 is reported on:
arg JOIN insn 8 -> 10 r1: _ + fp0-8 => fp0-8|fp0+0
arg JOIN insn 8 -> 10 sa0: _ + fp0-8 => fp0-8|fp0+0
Update the r1 and sa0 expectations to the new output.
Fixes: f414d20879ae ("bpf: Save DFS postorder numbers for program instructions")
Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261018005348.2195130-4-kafai.wan@linux.dev
|
|
Commit 147400e9c27c ("bpf: Compute parameters liveness in
bpf_compute_live_registers()") stopped assuming that a call to a static
subprogram reads r1..r5 and now uses the callee's entry live-in. R1-R5 are
not live at these call insns, so __clean_func_state() clears them from the
caller state and the backtracked parent state prints as:
mark_precise: frame0: parent state regs= stack=: R10=fp0
Update both expectations accordingly.
Fixes: 147400e9c27c ("bpf: Compute parameters liveness in bpf_compute_live_registers()")
Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261018005348.2195130-3-kafai.wan@linux.dev
|
|
bpf_check_attach_target() rejects a freplace whose target is a static
function, using the subprog "unreliable" flag as a proxy for "static".
That flag is raised whenever a subprogram's BTF prototype disagrees with
the registers at its call site.
`147400e9c27c ("bpf: Compute parameters liveness in
bpf_compute_live_registers()")` made that work for static callees: a
static function with an unused argument no longer matches its BTF
prototype at the call site and is marked unreliable.
Since LLVM commit `29b36a16f111 ("[BPF] Emit ABI-accurate BTF
prototypes for DW_CC_nocall")` in 23.1 [1] that premise is gone:
BTFDebug may now drop arguments removed by the optimizer, so for
__noinline static int subprog(struct __sk_buff *ctx)
{
return bpf_ktime_get_ns();
}
compiled with clang 23 the BTF describes subprog() as
[75] FUNC_PROTO '(anon)' ret_type_id=2 vlen=0
[76] FUNC 'subprog' type_id=75 linkage=static
There is then no argument left to compare, the subprog stays reliable,
and the check in bpf_check_attach_target() is skipped. The freplace is
then rejected by the later linkage check instead, reporting "subprog()
is not a global function", and the selftest "exceptions" fails.
Determine staticness from the BTF linkage instead, and keep the
unreliable check for global functions whose BTF does not match their
call site.
There is no functional change: freplacing a static function was rejected
before and is still rejected with the same -EINVAL. Selftest "exceptions"
is updated to match.
[1] https://github.com/llvm/llvm-project/pull/198426
Fixes: 147400e9c27c ("bpf: Compute parameters liveness in bpf_compute_live_registers()")
Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261018005348.2195130-2-kafai.wan@linux.dev
|
|
The inlined expansion of bpf_get_func_arg() bounds-checks only the low 32
bits of the index, so a helper prototype that keeps the upper bits of the
index is needed to reach it.
Add check_wide_index() and call it from the fexit and tp_btf tests. It
drives the helper with indices that have upper bits set and with indices
whose low 32 bits are out of range, and it checks that the destination is
left untouched when the helper reports -EINVAL. Without the previous patch
the wide index is shifted as 64-bit and the load uses an address far
outside the context.
Signed-off-by: Woojin Ji <random6.xyz@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: https://patch.msgid.link/20261018-get-func-arg-v2-2-048848b3eddf@gmail.com
|
