Re: [RFC PATCH bpf-next v6 11/12] selftests/bpf: Add test for memcg_bpf_ops hierarchies
From: bot+bpf-ci@kernel.org
Date: 2026-02-04 09:28:35
Also in:
bpf, cgroups, linux-kselftest, linux-mm, lkml
quoted hunk ↗ jump to hunk
diff --git a/tools/testing/selftests/bpf/prog_tests/memcg_ops.c b/tools/testing/selftests/bpf/prog_tests/memcg_ops.c index 8c787439f..378ee3b3b 100644 --- a/tools/testing/selftests/bpf/prog_tests/memcg_ops.c +++ b/tools/testing/selftests/bpf/prog_tests/memcg_ops.c
[ ... ]
+void test_memcg_ops_hierarchies(void)
+{
+ int ret, first = -1, second = -1, third = -1;
+ struct memcg_ops *skel = NULL;[ ... ]
+cleanup: + bpf_link__destroy(link1); + bpf_link__destroy(link2); + bpf_link__destroy(link3); + memcg_ops__detach(skel); + memcg_ops__destroy(skel);
Can this crash if skel is NULL? Unlike the other tests in this file
which guard these calls with if (skel), this cleanup path calls
memcg_ops__detach() unconditionally. If any of the earlier goto cleanup
paths are taken before memcg_ops__open_and_load() succeeds, skel remains
NULL.
The generated skeleton __detach() function does not have a NULL check:
static inline void
%1$s__detach(struct %1$s *obj)
{
bpf_object__detach_skeleton(obj->skeleton);
}
This would dereference NULL when accessing obj->skeleton.
For comparison, test_memcg_ops_over_high(), test_memcg_ops_below_low_over_high(),
and test_memcg_ops_below_min_over_high() in the same file all use:
if (skel) {
memcg_ops__detach(skel);
memcg_ops__destroy(skel);
}
+ close(first); + close(second); + close(third); + cleanup_cgroup_environment(); +}
--- AI reviewed your patch. Please fix the bug or email reply why it's not a bug. See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21665371660 AI-authorship-score: low AI-authorship-explanation: The code follows consistent patterns with other tests in the file and uses standard BPF selftest conventions, suggesting human authorship with good domain knowledge. issues-found: 1 issue-severity-score: low issue-severity-explanation: NULL pointer dereference crash in selftest cleanup path when cgroup setup fails, affecting test reliability but not production kernel code.