From: Jiayuan Chen <jiayuan.chen@linux.dev>
To: bpf@vger.kernel.org, mptcp@lists.linux.dev
Cc: Jiayuan Chen <jiayuan.chen@linux.dev>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
John Fastabend <john.fastabend@gmail.com>,
Andrii Nakryiko <andrii@kernel.org>,
Eduard Zingerman <eddyz87@gmail.com>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>,
Martin KaFai Lau <martin.lau@linux.dev>,
Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
Jiri Olsa <jolsa@kernel.org>,
Emil Tsalapatis <emil@etsalapatis.com>,
Ihor Solodrai <ihor.solodrai@linux.dev>,
Shuah Khan <shuah@kernel.org>,
Matthieu Baerts <matttbe@kernel.org>,
Mat Martineau <martineau@kernel.org>,
Geliang Tang <geliang@kernel.org>,
Yazhou Tang <tangyazhou518@outlook.com>,
Tejun Heo <tj@kernel.org>,
Matt Bobrowski <mattbobrowski@google.com>,
Nicolas Rybowski <nicolas.rybowski@tessares.net>,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
netdev@vger.kernel.org
Subject: [PATCH bpf v1 2/2] selftests/bpf: add verifier tests for bpf_skc_to_mptcp_sock
Date: Thu, 17 Sep 2026 16:11:58 +0800 [thread overview]
Message-ID: <20260917081209.361367-2-jiayuan.chen@linux.dev> (raw)
In-Reply-To: <20260917081209.361367-1-jiayuan.chen@linux.dev>
Cover what the verifier has to get right for the msk returned by
bpf_skc_to_mptcp_sock(): it must not be accepted by bpf_sk_release(), it
must go away with the subflow it was derived from, and the subflow
reference still has to be released.
# ./test_progs -t verifier_mptcp
#658/1 verifier_mptcp/bpf_skc_to_mptcp_sock: release the acquired subflow:OK
#658/2 verifier_mptcp/bpf_skc_to_mptcp_sock: msk is not the acquired subflow:OK
#658/3 verifier_mptcp/bpf_skc_to_mptcp_sock: msk dies with the subflow it came from:OK
#658/4 verifier_mptcp/bpf_skc_to_mptcp_sock: subflow is still owned after the cast:OK
#658 verifier_mptcp:OK
Summary: 1/4 PASSED, 0 SKIPPED, 0/0 FAILED
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
.../selftests/bpf/prog_tests/verifier.c | 2 +
.../selftests/bpf/progs/verifier_mptcp.c | 101 ++++++++++++++++++
2 files changed, 103 insertions(+)
create mode 100644 tools/testing/selftests/bpf/progs/verifier_mptcp.c
diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
index f7f94ccebce2..63316e4be6bb 100644
--- a/tools/testing/selftests/bpf/prog_tests/verifier.c
+++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
@@ -74,6 +74,7 @@
#include "verifier_mem_size_reg.skel.h"
#include "verifier_meta_access.skel.h"
#include "verifier_movsx.skel.h"
+#include "verifier_mptcp.skel.h"
#include "verifier_mtu.skel.h"
#include "verifier_mul.skel.h"
#include "verifier_netfilter_ctx.skel.h"
@@ -238,6 +239,7 @@ void test_verifier_may_goto_2(void) { RUN(verifier_may_goto_2); }
void test_verifier_mem_size_reg(void) { RUN(verifier_mem_size_reg); }
void test_verifier_meta_access(void) { RUN(verifier_meta_access); }
void test_verifier_movsx(void) { RUN(verifier_movsx); }
+void test_verifier_mptcp(void) { RUN(verifier_mptcp); }
void test_verifier_mul(void) { RUN(verifier_mul); }
void test_verifier_netfilter_ctx(void) { RUN(verifier_netfilter_ctx); }
void test_verifier_netfilter_retcode(void) { RUN(verifier_netfilter_retcode); }
diff --git a/tools/testing/selftests/bpf/progs/verifier_mptcp.c b/tools/testing/selftests/bpf/progs/verifier_mptcp.c
new file mode 100644
index 000000000000..1f679265e043
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/verifier_mptcp.c
@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include "bpf_tracing_net.h"
+#include <bpf/bpf_helpers.h>
+#include "bpf_misc.h"
+
+char _license[] SEC("license") = "GPL";
+
+__u32 token;
+
+static __always_inline struct bpf_sock *lookup_subflow(struct __sk_buff *skb)
+{
+ struct bpf_sock_tuple tuple = {};
+
+ return bpf_skc_lookup_tcp(skb, &tuple, sizeof(tuple.ipv4),
+ BPF_F_CURRENT_NETNS, 0);
+}
+
+SEC("tc")
+__description("bpf_skc_to_mptcp_sock: release the acquired subflow")
+__success
+int mptcp_cast_release_subflow(struct __sk_buff *skb)
+{
+ struct mptcp_sock *msk;
+ struct bpf_sock *sk;
+
+ sk = lookup_subflow(skb);
+ if (!sk)
+ return 0;
+
+ msk = bpf_skc_to_mptcp_sock(sk);
+ if (msk)
+ token = msk->token;
+
+ bpf_sk_release(sk);
+ return 0;
+}
+
+SEC("tc")
+__description("bpf_skc_to_mptcp_sock: msk is not the acquired subflow")
+__failure __msg("release helper bpf_sk_release expects referenced PTR_TO_BTF_ID")
+int mptcp_cast_release_msk(struct __sk_buff *skb)
+{
+ struct mptcp_sock *msk;
+ struct bpf_sock *sk;
+
+ sk = lookup_subflow(skb);
+ if (!sk)
+ return 0;
+
+ msk = bpf_skc_to_mptcp_sock(sk);
+ if (!msk) {
+ bpf_sk_release(sk);
+ return 0;
+ }
+
+ bpf_sk_release((struct bpf_sock *)msk);
+ return 0;
+}
+
+SEC("tc")
+__description("bpf_skc_to_mptcp_sock: msk dies with the subflow it came from")
+__failure __msg("invalid mem access 'scalar'")
+int mptcp_cast_use_after_release(struct __sk_buff *skb)
+{
+ struct mptcp_sock *msk;
+ struct bpf_sock *sk;
+
+ sk = lookup_subflow(skb);
+ if (!sk)
+ return 0;
+
+ msk = bpf_skc_to_mptcp_sock(sk);
+ if (!msk) {
+ bpf_sk_release(sk);
+ return 0;
+ }
+
+ bpf_sk_release(sk);
+ token = msk->token;
+ return 0;
+}
+
+SEC("tc")
+__description("bpf_skc_to_mptcp_sock: subflow is still owned after the cast")
+__failure __msg("Unreleased reference")
+int mptcp_cast_leak_subflow(struct __sk_buff *skb)
+{
+ struct mptcp_sock *msk;
+ struct bpf_sock *sk;
+
+ sk = lookup_subflow(skb);
+ if (!sk)
+ return 0;
+
+ msk = bpf_skc_to_mptcp_sock(sk);
+ if (msk)
+ token = msk->token;
+
+ return 0;
+}
--
2.43.0
next prev parent reply other threads:[~2026-09-17 8:12 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-17 8:11 [PATCH bpf v1 1/2] mptcp, bpf: reject bpf_sk_release() on msk Jiayuan Chen
2026-09-17 8:11 ` Jiayuan Chen [this message]
2026-09-17 9:19 ` [PATCH bpf v1 2/2] selftests/bpf: add verifier tests for bpf_skc_to_mptcp_sock bot+bpf-ci
2026-09-17 9:39 ` [PATCH bpf v1 1/2] mptcp, bpf: reject bpf_sk_release() on msk Matthieu Baerts
2026-09-17 11:06 ` Kalpan Jani
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260917081209.361367-2-jiayuan.chen@linux.dev \
--to=jiayuan.chen@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=geliang@kernel.org \
--cc=ihor.solodrai@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=martineau@kernel.org \
--cc=mattbobrowski@google.com \
--cc=matttbe@kernel.org \
--cc=memxor@gmail.com \
--cc=mptcp@lists.linux.dev \
--cc=netdev@vger.kernel.org \
--cc=nicolas.rybowski@tessares.net \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=tangyazhou518@outlook.com \
--cc=tj@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®