summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
2026-07-08Merge tag 'hid-for-linus-2026070801' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - OOB, UAF, NULL-deref fixes in core and picolcd, logitech, letsketch, appleir and multitouch drivers (Georgiy Osokin, HyeongJun An, Lee Jones, Manish Khadka, Maoyi Xie and Trung Nguyen) - fix for integer wraparound (and corresponding regression selftest) in hid-bpf (Yiyang Chen) * tag 'hid-for-linus-2026070801' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: selftests/hid: multitouch: test a large ContactCountMaximum HID: multitouch: fix out-of-bounds bit access on mt_io_flags selftests/hid: Cover hid_bpf_get_data() size overflow selftests/hid: Load only requested struct_ops maps HID: bpf: Fix hid_bpf_get_data() range check HID: lg-g15: cancel pending work on remove to fix a use-after-free HID: logitech-dj: Fix maxfield check in DJ short report validation HID: core: Fix OOB read in hid_get_report for numbered reports HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() HID: appleir: fix UAF on pending key_up_timer in remove() HID: letsketch: fix UAF on inrange_timer at driver unbind
2026-07-08selftests/user_events: Wait for deferred event teardown after unregisterMichael Bommarito
Unregistering a user event now defers the drop of the enabler's event reference (and the freeing of the enabler) past an RCU grace period. As a result DIAG_IOCSDEL can transiently fail with -EBUSY while that last reference is still being dropped, where it previously succeeded immediately. Two tests assumed the delete takes effect the instant the unregister returns: - abi_test "flags" deletes the event right after disabling it. - perf_test's fixture teardown clear() deletes __test_event before the next test registers the same name; a stale event makes the following registration fail with -EADDRINUSE. Retry the delete until it succeeds (or the event is already gone) with a bounded wait, matching the existing wait_for_delete() idiom in the same suite, so the tests are robust to the deferred teardown. Link: https://patch.msgid.link/20260707180240.2887081-1-michael.bommarito@gmail.com Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-07-08selftests: drv-net: xdp: run with both IP versionsNimrod Oren
Parameterize test cases by IP version using @ksft_variants. Set the environment's IP version at the start of each case using a new local helper, which also handles restoring the original value via defer(). The last case is left unparameterized because it does not send traffic or exercise IP-version-specific code. While here, fix an int vs str comparison bug `if cfg.addr_ipver == 4`. Suggested-by: Jakub Kicinski <kuba@kernel.org> Reviewed-by: Carolina Jubran <cjubran@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Nimrod Oren <noren@nvidia.com> Link: https://patch.msgid.link/20260702062348.2123960-3-noren@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-08selftests: drv-net: allow switching env IP versionNimrod Oren
NetDrvEpEnv picks a single IP version at init time, preferring IPv6 when both are configured. Add NetDrvEpEnv.set_ipver() to reselect the IP version and recompute the derived address fields. Reviewed-by: Carolina Jubran <cjubran@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Nimrod Oren <noren@nvidia.com> Link: https://patch.msgid.link/20260702062348.2123960-2-noren@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-08syscall_user_dispatch: Make it configurable in KconfigGregory Price
Syscall User Dispatch is presently built under CONFIG_GENERIC_SYSCALL and cannot be disabled independently. Add CONFIG_SYSCALL_USER_DISPATCH to make it an optional feature. Signed-off-by: Gregory Price <gourry@gourry.net> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260706140020.873735-2-gourry@gourry.net
2026-07-08selftests/net/openvswitch: add output truncation testMinxi Hou
Add test_trunc exercising the OVS_ACTION_ATTR_TRUNC action. The test verifies truncation limits in four steps: reject trunc(1) and trunc(13) which are below ETH_HLEN, confirm normal forwarding works, apply trunc(14) which truncates packets to the Ethernet header and verify ping fails, then restore normal forwarding and verify recovery. The kernel requires max_len >= ETH_HLEN (14 bytes). trunc(14) sets OVS_CB(skb)->cutlen so pskb_trim strips the IP payload at output time; the receiver drops the runt frame and no echo reply is generated. Signed-off-by: Minxi Hou <houminxi@gmail.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260702074926.1174810-1-houminxi@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-08selftests: gpio: add gpio-cdev-uaf to .gitignoreCihan Karadag
Commit c7f92042d3f3 ("selftests: gpio: Add gpio-cdev-uaf tests") added the gpio-cdev-uaf binary to TEST_GEN_PROGS_EXTENDED but never added it to .gitignore. Building it with: make -C tools/testing/selftests/gpio TARGETS=gpio leaves gpio-cdev-uaf as an untracked file. Fixes: c7f92042d3f3 ("selftests: gpio: Add gpio-cdev-uaf tests") Signed-off-by: Cihan Karadag <cihan.cihan@gmail.com> Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org> Link: https://patch.msgid.link/20260707235707.1349969-1-cihan.cihan@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-07-08selftests/bpf: Add untrusted BTF write regressionKumar Kartikeya Dwivedi
Add a TCP congestion-control struct_ops load test for a write through a BTF pointer produced by bpf_rdonly_cast(). The test expects the verifier to reject the program before the TCP CA btf_struct_access callback can whitelist the tcp_sock field write. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Reviewed-by: Amery Hung <ameryhung@gmail.com> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-08selftests/bpf: Rename libarena struct bitmap to struct arena_bitmapYonghong Song
When building bpf selftest with latest bpf-next, I got the following failure: In file included from /home/yhs/work/bpf-next/tools/testing/selftests/bpf/libarena/selftests/test_parallel_bitmap.bpf.c:8: /home/yhs/work/bpf-next/tools/testing/selftests/bpf/libarena/include/libarena/bitmap.h:11:8: error: redefinition of 'bitmap' 11 | struct bitmap { | ^ /home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/include/vmlinux.h:51320:8: note: previous definition is here 51320 | struct bitmap { | ^ The vmlinux.h struct bitmap comes from drivers/md/md-bitmap.c: struct bitmap { struct bitmap_counts { ... } ... } To fix the issue, I renamed libarena struct bitmap to arena_bitmap to avoid the conflict. Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260707220136.910374-1-yonghong.song@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07selftests: riscv: Bypass libc in inactive vector ptrace testAndrew Jones
The ptrace_v_not_enabled test expects the child to reach its ebreak before it has used the vector extension. That is not guaranteed when using fork(), because libc may run child atfork handlers before returning to the test code. In those cases PTRACE_GETREGSET for NT_RISCV_VECTOR then succeeds instead of returning ENODATA for inactive vector state. Use the raw clone syscall with SIGCHLD to keep fork-like semantics while bypassing libc's fork wrapper and atfork handler chain. Cc: Andy Chiu <tchiu@tenstorrent.com> Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Link: https://patch.msgid.link/20260707153827.175245-1-andrew.jones@oss.qualcomm.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-07-08selftests/bpf: Test cases for missing spill typesEduard Zingerman
A few selftests checking that the verifier represents spills for the following pointer types w/o losing precision: - PTR_TO_INSN - PTR_TO_TP_BUFFER - CONST_PTR_TO_DYNPTR Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260707-missing-spillable-types-v1-2-44a92121dc41@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07selftests: timers: leap-a-day: Fix -w option and update usage commentJiangshan Yi
Commit 98b74e1f3104 ("kselftests: timers: leap-a-day: Change default arguments to help test runs") replaced the -s option with -w and made "wait for the leap second" the non-default behaviour, but it only updated the switch/case handling. Two things were left inconsistent: - The getopt() option string still lists 's' instead of 'w', so passing -w is rejected as an invalid option and the new behaviour cannot be selected at all. - The file header comment still documents the removed -s option and an outdated default for -i. Fix the getopt() string to accept 'w' (matching the existing case 'w': handler) and update the header comment to describe -w, -t and the current -i default. Fixes: 98b74e1f3104 ("kselftests: timers: leap-a-day: Change default arguments to help test runs") Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Acked-by: John Stultz <jstultz@google.com> Link: https://patch.msgid.link/20260702093915.2652638-1-yijiangshan@kylinos.cn
2026-07-07selftests/lsm: Fix memory leak in attr_lsm_countWang Yan
The calloc-allocated buffer in attr_lsm_count() is never released on any exit path, including both the normal return path and the early return when read_sysfs_lsms fails, resulting in a heap memory leak. Add free() for the buffer on all return branches to fix the leak. Fixes: d3d929a8b0cd ("LSM: selftests for Linux Security Module syscalls") Signed-off-by: Wang Yan <wangyan01@kylinos.cn> Reviewed-by: William Roberts <bill.c.roberts@gmail.com> Tested-by: William Roberts <bill.c.roberts@gmail.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-07selftests/bpf: Fix memory leak in msg_alloc_iovFeng Yang
In the msg_alloc_iov function, the iov pointer is only assigned to msg->msg_iov after all memory allocations complete successfully. Therefore, when a calloc failure triggers the unwind_iov cleanup branch, we should use the local variable iov instead of msg->msg_iov. Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap") Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Reviewed-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20260707081434.539327-1-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07selftests/bpf: Drop tc/xdp/flow_dissector/socket_filter sockmap mutation testsSechang Lim
tc, xdp, socket_filter and flow_dissector programs can no longer update or delete a sockmap. Adjust the tests: - verifier_sockmap_mutate: the tc, xdp, socket_filter and flow_dissector cases now expect __failure with "cannot update sockmap in this context". - sockmap_basic: drop "sockmap update" / "sockhash update", which load a SEC("tc") program that copies a sock between maps. - fexit_bpf2bpf: drop "func_sockmap_update", whose freplace program updates a sockmap in the tc cls_redirect context. Remove the now-unused test_sockmap_update.c and freplace_cls_redirect.c. Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: John Fastabend <john.fastabend@gmail.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260630145410.3648099-3-rhkrqnwk98@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07KVM: selftests: Add xAPIC support in eventfd IRQ testDavid Matlack
Extend the eventfd IRQ test with a '-x' flag to let the user run the test in xAPIC mode instead of the default x2APIC mode. When using xAPIC mode, sanity check user input to ensure the test is being run with at most 255 vCPUs, as xAPIC can only address IDs 0-254 (255, i.e. 0xff, broadcasts to all CPUs). Signed-off-by: David Matlack <dmatlack@google.com> Co-developed-by: Josh Hilke <jrhilke@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: add sanity check on number of vCPUs] Link: https://patch.msgid.link/20260626213534.3866178-21-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Make number of vCPUs configurable in IRQ testDavid Matlack
Extend the eventfd IRQ test with a '-v' flag to allow the user to configure the number of vCPUs to create and run (versus only ever using a single vCPU). Update the routing logic to play nice with 32 bit IDs, enable x2APIC format in KVM (to enable 32-bit ID routing), and disable KVM's x2APIC broadcast quirk so that targeting vCPU 255 doesn't blast the interrupt to all vCPUs when in x2APIC mode. Signed-off-by: David Matlack <dmatlack@google.com> Co-developed-by: Josh Hilke <jrhilke@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> Co-developed-by: Sean Christopherson <seanjc@google.com> Link: https://patch.msgid.link/20260626213534.3866178-20-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Verify vCPU migration during IRQ delivery in IRQ testDavid Matlack
Extend the eventfd IRQ test with a '-m' flag to have the test migrate the target vCPU to a random physical CPU before triggering its interrupt, e.g. to validate KVM's ability to update device posted IRQ routing. Signed-off-by: David Matlack <dmatlack@google.com> Co-developed-by: Josh Hilke <jrhilke@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: pin one vCPU at a time to simplify things, use main()'s affinity] Link: https://patch.msgid.link/20260626213534.3866178-19-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Add a utility to pin a task to a random CPU, given a CPU setJosh Hilke
Add a helper function, pin_task_to_random_cpu(), to pin a task to a random CPU from a given cpu_set_t. This helper will be used eventfd IRQ test to migrate vCPUs to random pCPUs, to stress host-side interrupt routing and delivery. Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: massage changelog] Link: https://patch.msgid.link/20260626213534.3866178-18-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Add kvm_sched_getaffinity() wrapper and convert usersJosh Hilke
Add and use a KVM wrapper for the sched_getaffinity() syscall so that selftests don't need to manually assert that the syscall succeeded. Note, some tests didn't actually assert success, but they all obviously rely on the syscall to succeed. Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: massage changelog] Link: https://patch.msgid.link/20260626213534.3866178-17-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Add kvm_gettid() wrapper and convert usersJosh Hilke
Add a KVM wrapper for the gettid() syscall so that tests don't have to open code the syscall() themselves. Unfortunately, not all flavors of libc that KVM selftests support provide gettid(). Convert all existing users of the syscall to the new wrapper. Note, per the gettid() manpage[1], "This call is always successful", i.e. prefixing kvm_ to the syscall name is aligned with the goal of providing syscall wrappers that guarantee success. No functional changes intended. Link: https://man7.org/linux/man-pages/man2/gettid.2.html [1] Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: massage changelog] Link: https://patch.msgid.link/20260626213534.3866178-16-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Verify non-postable IRQ remapping in IRQ testSean Christopherson
Extend the eventfd IRQ test with an '-n' flag to route a subset of device interrupts as NMIs (Non-Maskable Interrupts) into the guest using an alternating pattern of 4 NMIs followed by 4 regular interrupts. While this adds coverage for NMI injection, the primary goal is to validate KVM's handling of non-postable interrupt delivery (AMD and Intel IOMMUs only support posting fixed IRQs targeting a single vCPU). KVM has historically bungled handling transitions between posted and remapped modes. Use NMIs to stress the transitions, because they are a reliable, architectural way to force these code paths. Signed-off-by: David Matlack <dmatlack@google.com> Co-developed-by: Josh Hilke <jrhilke@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: add GUEST_RECEIVED_INTERRUPT(), massage changelog] Link: https://patch.msgid.link/20260626213534.3866178-15-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Make number of IRQs configurable in IRQ testDavid Matlack
Extend the eventfd IRQ test with a '-i' flag to let the user specify the the number of IRQs to generate (instead of hardcoding the test to always generate 1000 interrupts). Signed-off-by: David Matlack <dmatlack@google.com> Co-developed-by: Josh Hilke <jrhilke@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: massage changelog] Link: https://patch.msgid.link/20260626213534.3866178-14-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Add option to set empty routing between IRQs in eventfd IRQ testDavid Matlack
Extend the eventfd IRQ test with an '-e' flag to set empty GSI routing between interrupts. Clobbering the GSI routing table verifies that KVM correctly handles CPUx => NULL => CPUy transitions, not just CPUx => CPUy transitions, and verifies that KVM can "rebuild" an entire routing setup. Signed-off-by: David Matlack <dmatlack@google.com> Co-developed-by: Josh Hilke <jrhilke@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: '-e' for "empty" instead of '-c' for "clear", massage changelog] Link: https://patch.msgid.link/20260626213534.3866178-13-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Verify interrupts are received when IRQ affinity changes in ↵David Matlack
IRQ test Extent the eventfd IRQ test with a '-a' flag to randomly affinitize the device's host IRQ to different physical CPUs throughout the test. This stresses the kernel's ability to maintain correct interrupt routing and delivery even as the underlying hardware IRQ affinity is changed dynamically via /proc/<irq>/smp_affinity{,_list}. Signed-off-by: David Matlack <dmatlack@google.com> Co-developed-by: Josh Hilke <jrhilke@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: massage changelog] Link: https://patch.msgid.link/20260626213534.3866178-12-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Add a helper to set proc IRQ affinity for IRQ testJosh Hilke
Add a utility, proc_irq_set_smp_affinity(), to set the CPU affinity of a Linux host IRQ via the proc filesystem. Use smp_affinity_list instead of smp_affinity to avoid having to convert the single CPU to a bitmask. The helper will be used by the eventfd IRQ test to verify delivery of IRQs when the affinity is randomized/modified. Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: make the utility self-contained, drop "list", massage changelog] Link: https://patch.msgid.link/20260626213534.3866178-11-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Add VFIO device support to eventfd IRQ testDavid Matlack
Extend the eventfd IRQ test with a '-d' argument that takes a BDF (in the format segment:bus:device.function) of an interrupt-capable PCI(e) device bound to VFIO, and use said device to trigger interrupts instead of always synthesizing interrupts via direct writes to the eventfd. Using a VFIO device to trigger interrupts validates the end-to-end delivery of IRQs for "real" devices, and when supported by hardware (and KVM), also validates interrupt delivery via IRQ bypass, i.e. via device posted IRQs. Now that IOMMUFD is a thing, auto-probe IOMMUFD vs. "legacy" VFIO by temporarily opening /dev/iommufd, and skip the test if neither IOMMUFD nor legacy VFIO is available. Add a '-t' option to the user override the probe logic, e.g. in case IOMMUFD is available but the system is configured for legacy usage. Note, the device must have a VFIO selftest driver in order to work with the test. A helper script to list supported devices will hopefully be available in the near future at tools/testing/selftests/vfio/scripts/list_supported_devices.sh[1]. Example: $ ./tools/testing/selftests/kvm/irq_test -d 0000:06:0a.1 Link: https://lore.kernel.org/all/20260602222941.3133236-1-jrhilke%40google.com [1] Signed-off-by: David Matlack <dmatlack@google.com> Co-developed-by: Josh Hilke <jrhilke@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> Co-developed-by: Sean Christopherson <seanjc@google.com> Link: https://patch.msgid.link/20260626213534.3866178-10-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Add helper to get host IRQ from device MSI-X for IRQ bypass testDavid Matlack
Introduce proc_util.c and proc_util.h to house utility functions for interacting with the proc filesystem. Add vfio_msix_to_host_irq(), which parses /proc/interrupts, to get the host Linux IRQ for a given VFIO device BDF and MSI-X vector. This helper will be used by the eventfd IRQ test to print the host IRQ number when triggering IRQs via VFIO device, e.g. to aid in debugging if the test fails. Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: David Matlack <dmatlack@google.com> Co-developed-by: Josh Hilke <jrhilke@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: massage changelog] Link: https://patch.msgid.link/20260626213534.3866178-9-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Add an irqfd send+receive (and later IRQ bypass) testDavid Matlack
Add a new test, irq_test to verify that KVM correctly delivers interrupts to a running vCPU, when triggered via an eventfd bound to a KVM GSI using KVM's irqfd mechanism. This test is intentionally simple, for now. Support for sending interrupts via VFIO devices, for IRQ bypass, and for other features will be added in the near future. Add the test in common code, even though it currently will only build and run on x86, as the concept and the bulk of the host-side code isn't specific to x86. Suggested-by: Sean Christopherson <seanjc@google.com> Link: https://lore.kernel.org/kvm/20250404193923.1413163-68-seanjc@google.com Signed-off-by: David Matlack <dmatlack@google.com> Co-developed-by: Josh Hilke <jrhilke@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: use while() and TEST_ASSERT() instead of if-statement => TEST_FAIL()] Link: https://patch.msgid.link/20260626213534.3866178-8-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Add helper to generate random u64 in range [min,max]Josh Hilke
Introduce kvm_random_u64_in_range(state, min, max). This function returns a random u64 in the inclusive range of [min, max] using a struct kvm_random_state. Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> Link: https://patch.msgid.link/20260626213534.3866178-7-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Seed libc's RNG before using it to generate a seed for KVM's ↵Sean Christopherson
pRNG Seed the RNG used by random() using the de facto standard method of srand(time(0)), so that a different seed is actually used in each test run. E.g. without seeding the RNG, literally every test on x86 will use 0x6b8b4567 to seed the KVM RNG. Link: https://patch.msgid.link/20260626213534.3866178-6-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Initialize the default/global pRNG during kvm_selftest_init()Sean Christopherson
Initialize the default kvm_rng during selftest initialization so that the pRNG can be used by tests before creating a VM. As pointed out by Sashiko, failure to actually initialize the generate makes it decidedly not random. Link: https://patch.msgid.link/20260626213534.3866178-5-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Rename guest_rng to kvm_rngJosh Hilke
Rename functions prefixed with 'guest_random_' to 'kvm_random_' and the global random state variable 'guest_rng' to 'kvm_rng', as the pRNG isn't strictly limited to guest code. This will allow using the pRNG in host code without creating confusing/misleading function calls. No functional changes are intended. Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: massage changelog] Link: https://patch.msgid.link/20260626213534.3866178-4-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Add macros to read/write+sync to/from guest memoryDavid Matlack
Add SYNC_FROM_GUEST_AND_READ(vm, variable), to read a variable value from the guest. Add WRITE_AND_SYNC_TO_GUEST(vm, variable, value) to write a value to a guest variable. These macros improve the readability of code which reads and writes data between host and guest in tests. Use the new macro in existing tests that do back-to-back write+sync. No functional changes are intended. Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: David Matlack <dmatlack@google.com> Co-developed-by: Josh Hilke <jrhilke@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> [sean: massage changelog] Link: https://patch.msgid.link/20260626213534.3866178-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07KVM: selftests: Build and link selftests/vfio/lib into KVM selftestsDavid Matlack
Include libvfio.mk into the KVM selftests Makefile and link it into all KVM selftests by adding it to LIBKVM_OBJS. This lays the groundwork for future changes to utilize VFIO devices to verify IRQ bypass in KVM selftests. Note that KVM selftests build their own copy of selftests/vfio/lib and the resulting object files are placed in $(OUTPUT)/lib. This allows the KVM and VFIO selftests to apply different CFLAGS when building without conflicting with each other. Signed-off-by: David Matlack <dmatlack@google.com> Signed-off-by: Josh Hilke <jrhilke@google.com> Link: https://patch.msgid.link/20260626213534.3866178-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-07selftests/bpf: Add test for bpf_get_smp_processor_idMaxim Khmelevskii
Add a test which checks on each CPU that the bpf_get_smp_processor_id BPF helper is returning the correct CPU number. Signed-off-by: Maxim Khmelevskii <max@linux.ibm.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Link: https://lore.kernel.org/bpf/20260703125648.919196-6-max@linux.ibm.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07selftests/bpf: Cover MEM_ALLOC access past object boundsYiyang Chen
Add a linked_list negative loader case for a program-BTF type whose last member is a zero-length flexible array. The program writes through the first flexible-array element of an object allocated by bpf_obj_new(). The verifier should reject the access when the BTF walk reaches beyond the static size of the allocated object. Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/e36fd5d2f4047809f0e5da46a7077083297e64db.1782807039.git.chenyy23@mails.tsinghua.edu.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07selftests/bpf: Fix memory leak in msg_alloc_iov error pathMalaya Kumar Rout
In msg_alloc_iov(), when calloc() fails for an individual iov_base allocation, the error path frees all previously allocated iov_base entries but fails to free the iov array itself that was allocated with calloc() at the beginning of the function. This results in a memory leak of the iov array. Add free(iov) in the unwind_iov error path to ensure proper cleanup of all allocated memory. Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap") Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260704122936.102394-1-malayarout91@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07selftests/bpf: libarena: Add parallel bitmap selftestEmil Tsalapatis
Add a selftest for testing the atomic bitmap set/clear/ test_and_set/test_and_clear operations. The selftest checks atomicity by spawning two threads, each of which either only works on even bits or with odd bits. The test checks that threads do not affect each other's bits. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260706181730.21731-7-emil@etsalapatis.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07selftests/bpf: libarena: Add bitmap selftestsEmil Tsalapatis
Add testing for the new arena bitmap data structure. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/bpf/20260706181730.21731-6-emil@etsalapatis.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07selftests/bpf: Add arena-based bitmap data structureEmil Tsalapatis
Add an arena-based word-aligned bitmap data struture. The structure is useful as a building block, e.g., sched-ext uses it to represent cpumask structures. Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260706181730.21731-5-emil@etsalapatis.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07selftests/bpf: libarena: Clean up allocation state before buddy testsEmil Tsalapatis
Summary: The buddy allocator requires the global BPF buddy allocator to not be already initialized. However, the test currently merely resets the allocator before the buddy tests instead of destroying it, and the test worked because the buddy test happened to run first. Properly destroy the allocator instead of resetting it. Fixes: b1487dc1b181 ("selftests/bpf: Add selftests for libarena buddy allocator") Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/bpf/20260706181730.21731-4-emil@etsalapatis.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07selftests/bpf: libarena: Fix can-loop zero variable definitionEmil Tsalapatis
BPF can_loop based loops require the index variable to stay imprecise. This means we must initialize them from a currently imprecise variable instead of directly assigning 0 to them, like so: static volatile u32 zero = 0; for (i = zero; i < NUM_LOOPS; i++) { /* loop body */ } The libarena implementation of this technique is currently faulty. For the technique to work, the variable must not be in a map. This includes the .rodata DATASEC map used for const variables. However, libarena still defines the zero variable as constant. Modify the zero variable definition into a volatile variable. This change adds a complication caused by the compiler optimizing array derefences from for (i = zero; i < NUM_LOOPS; i++) { val = *(ptr + i); } into for (i = zero; i < NUM_LOOPS; i++) { val = *ptr++; } and causing verification failures. Use the barrier_var() clobber macro to prevent this optimization from taking place. Using barrier_var() is the only way to break the optimization, as annotating the index as volatile does not suffice. After that, remove the bpf_for() invocations introduced in libarena for parallel spmc testing. Reported-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260706181730.21731-3-emil@etsalapatis.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07selftests/bpf: libarena: Replace leftover st_ prefix with test_Emil Tsalapatis
The st_ (selftests_) prefix is confusing and has been replaced with the more descriptive test_. However, last patch did not properly move all files to the new prefix. Rename the existing files to complete the move. Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260706181730.21731-2-emil@etsalapatis.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-07Merge branch 'topic/firewire-include-fix' into for-linusTakashi Iwai
Pull header inclusion fix for firewire drivers Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-07-07selftests: drv-net: Add test for cross-esw rate schedulingCosmin Ratiu
Adds a Python selftest using the YNL devlink API to verify the devlink rate ops. The test requires a bond device given in the config as NETIF containing two PFs. Test setup will then create 1 VF on each PF and verify the various rate commands. ./devlink_rate_cross_esw.py TAP version 13 1..3 ok 1 devlink_rate_cross_esw.test_same_esw_parent ok 2 devlink_rate_cross_esw.test_cross_esw_parent ok 3 devlink_rate_cross_esw.test_tx_rates_on_cross_esw Tests will be skipped when the preconditions aren't met, when the devlink API is too old or when the devices don't appear to support cross-esw scheduling (detected via EOPNOTSUPP). Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Carolina Jubran <cjubran@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260701073254.754518-14-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-06Merge tag 'mm-hotfixes-stable-2026-07-06-17-49' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "20 hotfixes. 17 are for MM. 12 are cc:stable and the remaining 8 address post-7.1 issues or aren't considered suitable for backporting. Two patches from SJ addresses a couple of quite old DAMON issues. And two patches from Yichong Chen fixes tools/virtio build issues. The remaining patches are singletons" * tag 'mm-hotfixes-stable-2026-07-06-17-49' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: tools/include: include stdint.h for SIZE_MAX in overflow.h tools/virtio: add missing compat definitions for vhost_net_test mm: do file ownership checks with the proper mount idmap samples/damon/mtier: fail early if address range parameters are invalid mm: a second pagecache maintainer mm/damon: add a kernel-doc comment for damon_ctx->rnd_state mm/damon: add a kernel-doc comment for damon_ctx->probes mailmap: add entries for Radu Rendec selftests/mm: hmm-tests: include linux/mman.h to access MADV_COLLAPSE selftests/mm: pagemap_ioctl: use the correct page size for transact_test() fs/proc: fix KPF_KSM reported for all anonymous pages mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access mm/damon/ops-common: handle extreme intervals in damon_hot_score() MAINTAINERS: add Lance as an rmap reviewer mm/compaction: handle free_pages_prepare() properly in compaction_free() mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() mm: shrinker: fix NULL pointer dereference in debugfs mm: shrinker: fix shrinker_info teardown race with expansion selftests/mm: fix ksft_process_madv.sh test category
2026-07-06KVM: arm64: selftests: Add MMIO sign-extending load testFuad Tabba
Add a test for sign-extending MMIO loads (LDRSB, LDRSH, LDRSW) into Xt and Wt destinations, with and without the sign bit set. The host supplies the MMIO data and checks the guest register holds the sign-extended value. Repeat the loads big-endian on a mixed-endian implementation. Issue those at EL0: SCTLR_EL1.EE would make an EL1 load big-endian but also walk the little-endian page tables big-endian, whereas SCTLR_EL1.E0E selects only EL0 data endianness and leaves the walk little-endian. Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev> Link: https://patch.msgid.link/20260706115522.954913-3-fuad.tabba@linux.dev Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-07-06selftests: net: make busywait timeout clock portableNirmoy Das
loopy_wait() expects millisecond timestamps. However, Ubuntu Resolute can use uutils date, where `date -u +%s%3N` returns seconds plus full nanoseconds instead of a 3-digit millisecond field. This makes busywait expire too early and can make vlan_bridge_binding.sh read a stale operstate. Fixes: 25ae948b4478 ("selftests/net: add lib.sh") Cc: stable@vger.kernel.org # 6.8+ Link: https://github.com/uutils/coreutils/issues/11658 Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com> Link: https://patch.msgid.link/20260630165157.3814871-1-nirmoyd@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-06selftests/tc-testing: Add tests that force multiq and taprio to enqueue to ↵Victor Nogueira
child's gso_skb Add test cases to reproduce scenarios fixed recently [1] where multiqueue and taprio forced their children into enqueueing an skb to gso_skb (during peek), but failed to dequeue from gso_skb because they called the child's dequeue callback directly. This causes a desync in the child's qlen/backlog and results in an eventual null-ptr-deref (with a qfq or dualpi2 child). Test cases are the following: - Force multiq to dequeue from its child's gso_skb with qfq leaf (fb6c) - Force multiq to dequeue from its child's gso_skb with dualpi2 leaf (1922) - Force taprio to dequeue from its child's gso_skb with qfq leaf (476f) - Force taprio to dequeue from its child's gso_skb with dualpi2 leaf (0235) [1] https://lore.kernel.org/netdev/20260625-b4-disp-31bcb279-v1-0-85c40b83c529@proton.me/ Signed-off-by: Victor Nogueira <victor@mojatatu.com> Reviewed-by: Pedro Tammela <pctammela@mojatatu.com> Link: https://patch.msgid.link/20260630153651.249752-1-victor@mojatatu.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-20 11:03:00 +0000