* [PATCH bpf 2/2] selftests/bpf: Test that a drained task_vma iterator keeps returning NULL
2026-11-13 2:44 [PATCH bpf 1/2] bpf: make task_vma iterator stay drained after NULL Kang Chen
@ 2026-11-13 2:45 ` Kang Chen
2026-11-13 4:27 ` Alexei Starovoitov
0 siblings, 1 reply; 3+ messages in thread
From: Kang Chen @ 2026-11-13 2:45 UTC (permalink / raw)
To: Yonghong Song, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi
Cc: bpf, linux-kernel
Add a syscall program that walks the current task's VMAs, records the
last vm_end, drains the iterator and lets a user-space thread map a new
VMA at that address. The program waits in bpf_loop() until the mapping
is ready, then calls bpf_iter_task_vma_next() once more and stores the
raw result.
The user-space test checks that bpf_iter_task_vma_new() succeeded, that
at least one VMA was drained, that the mapper ran (go_seen), and that
the extra next() returned NULL. The new VMA makes the test fail on a
kernel without the drain state: the iterator would return the new VMA
again.
Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
---
.../selftests/bpf/prog_tests/task_vma_iter.c | 89 +++++++++++++++++++
.../selftests/bpf/progs/task_vma_iter.c | 53 +++++++++++
2 files changed, 142 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/task_vma_iter.c
create mode 100644 tools/testing/selftests/bpf/progs/task_vma_iter.c
diff --git a/tools/testing/selftests/bpf/prog_tests/task_vma_iter.c b/tools/testing/selftests/bpf/prog_tests/task_vma_iter.c
new file mode 100644
index 000000000000..bb9feb840a27
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/task_vma_iter.c
@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <test_progs.h>
+#include <bpf/libbpf.h>
+#include <pthread.h>
+#include <sched.h>
+#include <sys/mman.h>
+#include "task_vma_iter.skel.h"
+
+struct map_ctx {
+ struct task_vma_iter *skel;
+ void *addr;
+ int err;
+};
+
+static void *map_new_vma(void *arg)
+{
+ struct map_ctx *ctx = arg;
+ struct task_vma_iter *skel = ctx->skel;
+ void *addr;
+
+ while (!__atomic_load_n(&skel->bss->drain_done, __ATOMIC_RELAXED))
+ sched_yield();
+
+ if (!skel->bss->new_ret) {
+ addr = (void *)(unsigned long)skel->bss->last_end;
+ ctx->addr = mmap(addr, getpagesize(), PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE,
+ -1, 0);
+ if (ctx->addr == MAP_FAILED)
+ ctx->err = errno;
+ }
+
+ __atomic_store_n(&skel->bss->go, 1, __ATOMIC_RELEASE);
+ return NULL;
+}
+
+static void test_task_vma_iter_next_after_drain(void)
+{
+ LIBBPF_OPTS(bpf_test_run_opts, topts);
+ struct task_vma_iter *skel;
+ struct map_ctx ctx;
+ pthread_t thread;
+ int err, fd;
+
+ skel = task_vma_iter__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "task_vma_iter__open_and_load"))
+ return;
+
+ ctx.skel = skel;
+ ctx.addr = NULL;
+ ctx.err = 0;
+
+ if (!ASSERT_OK(pthread_create(&thread, NULL, map_new_vma, &ctx),
+ "pthread_create"))
+ goto out;
+
+ fd = bpf_program__fd(skel->progs.iter_task_vma_next_after_drain);
+ err = bpf_prog_test_run_opts(fd, &topts);
+ if (err) {
+ /* Release the mapper if the program never ran. */
+ skel->bss->new_ret = -1;
+ __atomic_store_n(&skel->bss->drain_done, 1, __ATOMIC_RELEASE);
+ __atomic_store_n(&skel->bss->go, 1, __ATOMIC_RELEASE);
+ }
+ pthread_join(thread, NULL);
+
+ if (!ASSERT_OK(err, "test_run_opts err"))
+ goto out;
+ if (!ASSERT_OK(topts.retval, "test_run_opts retval"))
+ goto out;
+
+ ASSERT_OK(ctx.err, "mmap new VMA");
+ ASSERT_OK(skel->bss->new_ret, "new_ret");
+ ASSERT_GT(skel->bss->vma_count, 0, "vma_count");
+ ASSERT_EQ(skel->bss->go_seen, 1, "go_seen");
+ /* last_end is set, so a restarted walk would find the new VMA */
+ ASSERT_EQ(skel->data->next_after_drain, 0, "next_after_drain");
+
+out:
+ if (ctx.addr && ctx.addr != MAP_FAILED)
+ munmap(ctx.addr, getpagesize());
+ task_vma_iter__destroy(skel);
+}
+
+void test_task_vma_iter(void)
+{
+ if (test__start_subtest("next_after_drain"))
+ test_task_vma_iter_next_after_drain();
+}
diff --git a/tools/testing/selftests/bpf/progs/task_vma_iter.c b/tools/testing/selftests/bpf/progs/task_vma_iter.c
new file mode 100644
index 000000000000..9159aa7fc48e
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/task_vma_iter.c
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "vmlinux.h"
+#include "bpf_experimental.h"
+#include <bpf/bpf_helpers.h>
+
+char _license[] SEC("license") = "GPL";
+
+/* Result of a bpf_iter_task_vma_next() call after the iterator was drained */
+__u64 next_after_drain = -1;
+__u64 last_end;
+__u64 drain_done;
+__u64 go;
+int new_ret;
+int go_seen;
+__u64 vma_count;
+
+static long wait_for_go(u32 index, void *ctx)
+{
+ return go ? 1 : 0;
+}
+
+SEC("syscall")
+int iter_task_vma_next_after_drain(const void *ctx)
+{
+ struct task_struct *task = bpf_get_current_task_btf();
+ struct bpf_iter_task_vma it;
+ struct vm_area_struct *vma;
+
+ new_ret = bpf_iter_task_vma_new(&it, task, 0);
+ if (new_ret) {
+ drain_done = 1;
+ go = 1;
+ goto out;
+ }
+
+ while ((vma = bpf_iter_task_vma_next(&it))) {
+ vma_count++;
+ last_end = vma->vm_end;
+ }
+
+ /* Let user space map a new VMA at last_end before the extra next(). */
+ drain_done = 1;
+ bpf_loop(1000000, wait_for_go, NULL, 0);
+ go_seen = go;
+
+ /* Store the raw value; the verifier would remove a branch on it */
+ next_after_drain = (__u64)bpf_iter_task_vma_next(&it);
+
+out:
+ /* The destructor is called even when the constructor failed. */
+ bpf_iter_task_vma_destroy(&it);
+ return 0;
+}
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread