Re: [RFC PATCH bpf-next v2 09/11] selftests/bpf: Test using dynptr after freeing the underlying object
From: Eduard Zingerman <eddyz87@gmail.com>
Date: 2026-03-16 19:26:02
Also in:
bpf
On Fri, 2026-03-06 at 22:44 -0800, Amery Hung wrote: [...]
quoted hunk ↗ jump to hunk
@@ -223,6 +253,12 @@ void test_ns_bpf_qdisc(void) test_qdisc_attach_to_non_root(); if (test__start_subtest("incompl_ops")) test_incompl_ops(); + if (test__start_subtest("invalid_dynptr")) + test_invalid_dynptr(); + if (test__start_subtest("invalid_dynptr_slice")) + test_invalid_dynptr_slice(); + if (test__start_subtest("invalid_dynptr_cross_frame")) + test_invalid_dynptr_cross_frame(); }
Nit:
maybe consider using test_loader.c based infrastructure for failure tests?
E.g. like below:
+++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
@@ -115,6 +115,7 @@
#include "verifier_lsm.skel.h"
#include "verifier_jit_inline.skel.h"
#include "irq.skel.h"
+#include "bpf_qdisc_fail__invalid_dynptr.skel.h"
#define MAX_ENTRIES 11
@@ -259,6 +260,7 @@ void test_verifier_lsm(void) { RUN(verifier_lsm); }
void test_irq(void) { RUN(irq); }
void test_verifier_mtu(void) { RUN(verifier_mtu); }
void test_verifier_jit_inline(void) { RUN(verifier_jit_inline); }
+void test_bpf_qdisc_fail__invalid_dynptr(void) { RUN(bpf_qdisc_fail__invalid_dynptr); }
static int init_test_val_map(struct bpf_object *obj, char *map_name)
{
diff --git a/tools/testing/selftests/bpf/progs/bpf_qdisc_fail__invalid_dynptr.c b/tools/testing/selftests/bpf/progs/bpf_qdisc_fail__invalid_dynptr.c
index 2e76470bc261..f085872c3900 100644
--- a/tools/testing/selftests/bpf/progs/bpf_qdisc_fail__invalid_dynptr.c
+++ b/tools/testing/selftests/bpf/progs/bpf_qdisc_fail__invalid_dynptr.c
@@ -3,12 +3,14 @@
#include <vmlinux.h>
#include "bpf_experimental.h"
#include "bpf_qdisc_common.h"
+#include "bpf_misc.h"
char _license[] SEC("license") = "GPL";
int proto;
SEC("struct_ops")
+__failure
int BPF_PROG(bpf_qdisc_test_enqueue, struct sk_buff *skb, struct Qdisc *sch,
struct bpf_sk_buff_ptr *to_free)
{
For tests that exercise verifier failure messages this has some
benefits. E.g. the following command would reliably produce log
output even if program load succeeds:
./test_progs -vvv -a bpf_qdisc_fail__invalid_dynptr/bpf_qdisc_test_enqueue
And __msg annotations can be used to force-check the failure reason.
[...]