From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f176.google.com (mail-dy1-f176.google.com [74.125.82.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 594583955ED for ; Tue, 23 Jun 2026 21:50:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782251461; cv=none; b=DN26HtcGjvXmk7D+5ZB9PCkdmJo7joUq+arv8T4xdJ9ZKsOZtKtliDXBbDZEZ616Ksluq8VMKWyeVPaE+bvNcktxlK+UJWOxn2Xi4IAHdJbrzS0tk/Y2ODmMSRVHXiLeyA8d/HferL7wCvzyCpyePvFoikMWKR0NHwr7AK6jt7s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782251461; c=relaxed/simple; bh=AfKLgzwWQGEaXCQiwOYFEnHu532Ob2PVTdOP9IlN0+c=; h=Mime-Version:Content-Type:Date:Message-Id:Cc:Subject:From:To: References:In-Reply-To; b=Nx1p+ox4fNJ1MmmKOh3JVY6TLin6Ta+pJOFbOuykwzzuU353Cr2dFBbIZlg7ca/8Jw5xGecGViTWsoLEQo9t0BN7YyM4vRZAW2SfjdQAreyLn5FDirQwUvbwoL9pRH+Lq3ed9e89bzYM28ZOEJ5eYFqiEkHgLaUEGUb3X5krQdE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=etsalapatis.com; spf=pass smtp.mailfrom=etsalapatis.com; dkim=pass (2048-bit key) header.d=etsalapatis-com.20251104.gappssmtp.com header.i=@etsalapatis-com.20251104.gappssmtp.com header.b=CHFKymLZ; arc=none smtp.client-ip=74.125.82.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=etsalapatis.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=etsalapatis.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=etsalapatis-com.20251104.gappssmtp.com header.i=@etsalapatis-com.20251104.gappssmtp.com header.b="CHFKymLZ" Received: by mail-dy1-f176.google.com with SMTP id 5a478bee46e88-30bf8b2bd20so666188eec.0 for ; Tue, 23 Jun 2026 14:50:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=etsalapatis-com.20251104.gappssmtp.com; s=20251104; t=1782251457; x=1782856257; darn=vger.kernel.org; h=in-reply-to:references:to:from:subject:cc:message-id:date :content-transfer-encoding:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=CI0m2Bkca3T9X1wUQjN9Y3sphEwKAETg9MfJKMjr+2M=; b=CHFKymLZwff5cCj2b+xeC4NCzSVy6PxiCy64IMkGhBvk2tRgkGX5cclnXwLZG+f2/R +zOG+gqLo2KuDED2IBjwxrq6V5tGHCtaWaez1qYzisfPz+Nv/3gYBj1WYysxpFJfLI+G vClXBrc3xttcwFcnHvq2kjC3Izu3BC9On1v9CKtddDmv/XWPurifTj3KMrgfdCDDjpZO eG8RgJ+GB0Nbefz83l2pYp1jzt/ldFQ9W48uDgxpgg/7ugNLVgjKRU//zCQboYC5cMMb saDI0rd2E4BVoTXQ6Qdq1w5yDFJ14AVdWP18AMnr2Rm6aDRDDafsKV4LekBFotYz0/Ri KlUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782251457; x=1782856257; h=in-reply-to:references:to:from:subject:cc:message-id:date :content-transfer-encoding:mime-version:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=CI0m2Bkca3T9X1wUQjN9Y3sphEwKAETg9MfJKMjr+2M=; b=UdkHBj9UAbcyar7Yofbr9iJO/6k55TOrn+/dCbTukqC0pC5vvUp/aTfoTkYqibyC0c uJPazK/vukyQoPIbtNz9UABIptxGLQuhBNB4vSuvt6Ndy3tFkBGUpS0WRyLDyQHte/ws GXEQNBylN0dODUTj38sI6VhHMCANvroUzgw3ORNJ4BiJz+DX3D/HbN8X3ixyQKDd3fHZ lQGQMljloT+jXQ0xXQ+4gvU/fAMIFk7BgXnxjtiV53ess7M6s8okXRYBDpVAVNCBZ216 Ci7RV3a6RTAiD4VSIp48EvyvxUEO4wI3LabAk9jc9ZOBMjt4WKYPv+3qxRivyaBLE7IK Zf3g== X-Forwarded-Encrypted: i=1; AHgh+RpoGGJd6erzbAZTXZBChuomGp/RXn7iIjtOKMPaDi9EgleteAdLb9S9cYqTjXf3/vyidFkYYaz+oEGVQjw=@vger.kernel.org X-Gm-Message-State: AOJu0Yxf6bxxCnMoRlmjcFLX7Q07JiEoecuEycIEQhF+/6IUJMC6EnjB tMEy0dEAelkql6Rijlbk6XwagnVY1WfE+pZn3K+DW95XpiddrbnMo599LIb+ESOKcjY= X-Gm-Gg: AfdE7cls78m1VW9/3NUuQ2Y6/JjtW61PcMH0VGjhag5A6/2Hu8y2dJRXmR8rNhVccj/ 9O6ye4DYj70JfEd3TaktVuGMr4ysbCzK8yddCfM0wJ/NCQePFyVZO6lDradOC1S2pRgvpV5Pwht uEk+yJyPCxQ/3os9fT+P9SJhfvZjZHvPrfEYq4zc9w78mzD/mugLbv2tdE/vFxtVXHRa63c0y6P OpHlkZvY2juyccyJOr/a+pgLmUjnKeIevNIhwFKLG9+HCcKS7Y3IjNOpcbpKDqYHKIJ1xL6PiS4 9ppo0j92Ntq3uazVO8dyJoiCJJECivDNZxjouuekrK1P2xftn2jTA/J5xJ9zALWiA0WDJ6wZMQI 1hqhNEnPztHByx0xiGJHd3enGqYA0EjMRU8e3whf86oWOKVGlMp3S5CoHbi8IPwpUaqlq7BsOX/ dVx4dW X-Received: by 2002:a05:7300:23cf:b0:30c:1865:d9e0 with SMTP id 5a478bee46e88-30c1dbd9a00mr15340344eec.16.1782251457361; Tue, 23 Jun 2026 14:50:57 -0700 (PDT) Received: from localhost ([2620:10d:c090:600::2526]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30c52daf89dsm8970595eec.31.2026.06.23.14.50.55 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 23 Jun 2026 14:50:56 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Tue, 23 Jun 2026 17:50:53 -0400 Message-Id: Cc: "John Fastabend" , "Martin KaFai Lau" , "Song Liu" , "Yonghong Song" , "Jiri Olsa" , "Emil Tsalapatis" , "Shuah Khan" , "Viktor Malik" , "Leon Hwang" , "Dave Marchevsky" , , , Subject: Re: [PATCH bpf-next v4 2/2] selftests/bpf: Cover refcount acquire node offsets From: "Emil Tsalapatis" To: "Yiyang Chen" , "Alexei Starovoitov" , "Daniel Borkmann" , "Andrii Nakryiko" , "Eduard Zingerman" , "Kumar Kartikeya Dwivedi" X-Mailer: aerc 0.21.0-0-g5549850facc2 References: In-Reply-To: On Tue Jun 23, 2026 at 2:11 AM EDT, Yiyang Chen wrote: > Add regression coverage for bpf_refcount_acquire() on graph-node-derived > pointers. > > The rejected case passes a popped list node pointer directly to > bpf_refcount_acquire(), which must fail because the pointer carries a > non-zero fixed offset. > > Signed-off-by: Yiyang Chen Reviewed-by: Emil Tsalapatis > --- > .../bpf/progs/refcounted_kptr_fail.c | 34 +++++++++++++++++++ > 1 file changed, 34 insertions(+) > > diff --git a/tools/testing/selftests/bpf/progs/refcounted_kptr_fail.c b/t= ools/testing/selftests/bpf/progs/refcounted_kptr_fail.c > index 7247a20c0..024ef2aae 100644 > --- a/tools/testing/selftests/bpf/progs/refcounted_kptr_fail.c > +++ b/tools/testing/selftests/bpf/progs/refcounted_kptr_fail.c > @@ -13,12 +13,20 @@ struct node_acquire { > struct bpf_refcount refcount; > }; > =20 > +struct node_refcounted { > + long key; > + struct bpf_list_node list; > + struct bpf_refcount refcount; > +}; > + > extern void bpf_rcu_read_lock(void) __ksym; > extern void bpf_rcu_read_unlock(void) __ksym; > =20 > #define private(name) SEC(".data." #name) __hidden __attribute__((aligne= d(8))) > private(A) struct bpf_spin_lock glock; > private(A) struct bpf_rb_root groot __contains(node_acquire, node); > +private(B) struct bpf_spin_lock lock; > +private(B) struct bpf_list_head head __contains(node_refcounted, list); > =20 > static bool less(struct bpf_rb_node *a, const struct bpf_rb_node *b) > { > @@ -93,6 +101,32 @@ long rbtree_refcounted_node_ref_escapes_owning_input(= void *ctx) > return 0; > } > =20 > +SEC("?tc") > +__failure __msg("dereference of modified ptr_ ptr R1") > +long refcount_acquire_list_node_offset(void *ctx) > +{ > + struct node_refcounted *node, *base, *ref; > + struct bpf_list_node *list_node; > + > + node =3D bpf_obj_new(typeof(*node)); > + if (!node) > + return 1; > + > + bpf_spin_lock(&lock); > + bpf_list_push_front(&head, &node->list); > + list_node =3D bpf_list_pop_front(&head); > + bpf_spin_unlock(&lock); > + if (!list_node) > + return 2; > + > + base =3D container_of(list_node, struct node_refcounted, list); > + ref =3D bpf_refcount_acquire(list_node); > + if (ref) > + bpf_obj_drop(ref); > + bpf_obj_drop(base); > + return 0; > +} > + > SEC("?fentry.s/" SYS_PREFIX "sys_getpgid") > __failure __msg("function calls are not allowed while holding a lock") > int BPF_PROG(rbtree_fail_sleepable_lock_across_rcu,