summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
2026-05-13KVM: selftests: hyperv_tlb_flush: replace NOP loop with udelay()Piotr Zarycki
Replace the open-coded NOP loop with udelay() which was added to KVM selftests in commit 6b878cbb87bf ("KVM: selftests: Add guest udelay() utility for x86"). The NOP loop is CPU speed dependent while udelay() provides a deterministic delay regardless of host CPU frequency. Signed-off-by: Piotr Zarycki <piotr.zarycki@gmail.com> Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com> Link: https://patch.msgid.link/20260422130307.1171808-1-piotr.zarycki@gmail.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-05-13KVM: selftests: Fix typo in comment in hyperv_features.cPiotr Zarycki
Fix a typo in a comment: 'vailable' -> 'available'. Signed-off-by: Piotr Zarycki <piotr.zarycki@gmail.com> Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com> Link: https://patch.msgid.link/20260428083037.1926902-1-piotr.zarycki@gmail.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-05-13KVM: selftests: sync_regs_test: drop stale TODO commentPiotr Zarycki
The TODO asked for a build-time check to guard against missing new sync fields. Remove it, as code review is sufficient to catch such issues. Signed-off-by: Piotr Zarycki <piotr.zarycki@gmail.com> Link: https://patch.msgid.link/20260512161317.2580678-1-piotr.zarycki@gmail.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-05-13KVM: selftests: Include sys/mman.h *and* linux/mman.h, via kvm_syscalls.hSean Christopherson
Include both linux/mman.h (the kernel provided version) and sys/mman.h (the libc provided version) throughout KVM selftests, by way of kvm_syscalls.h (which should have been including sys/mman.h anyways). Pulling in the kernel's version fixes compilation errors with the guest_memfd test on older versions of libc due to a recent commit adding MADV_COLLAPSE testing. In file included from include/kvm_util.h:8, from guest_memfd_test.c:21: guest_memfd_test.c: In function ‘test_collapse’: guest_memfd_test.c:219:47: error: ‘MADV_COLLAPSE’ undeclared (first use in this function); did you mean ‘MADV_COLD’? 219 | TEST_ASSERT_EQ(madvise(mem, pmd_size, MADV_COLLAPSE), -1); | ^~~~~~~~~~~~~ include/test_util.h:62:16: note: in definition of macro ‘TEST_ASSERT_EQ’ 62 | typeof(a) __a = (a); \ | ^ guest_memfd_test.c:219:47: note: each undeclared identifier is reported only once for each function it appears in 219 | TEST_ASSERT_EQ(madvise(mem, pmd_size, MADV_COLLAPSE), -1); | ^~~~~~~~~~~~~ include/test_util.h:62:16: note: in definition of macro ‘TEST_ASSERT_EQ’ 62 | typeof(a) __a = (a); \ | ^ Route the includes through kvm_syscalls.h to try and avoid a future game of whack-a-mole, i.e. so that future expansion of test coverage doesn't run into the same problem. To discourage use of sys/mman.h, opportunistically include the kernel's version of mman.h in test_util.h as it only needs MAP_SHARED, i.e. only needs the full set of kernel defs, not the libc syscall wrappers. Fixes: 9830209b4ae8 ("KVM: selftests: Test MADV_COLLAPSE on guest_memfd") Reported-by: Rick Edgecombe <rick.p.edgecombe@intel.com> Closes: https://lore.kernel.org/all/20260427204313.50741-1-rick.p.edgecombe@intel.com Link: https://patch.msgid.link/20260428012503.1213654-1-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-05-13selftests/bpf: Enable stack argument tests for arm64Puranjay Mohan
Now that arm64 supports stack arguments, enable the existing stack_arg, stack_arg_kfunc and verifier_stack_arg tests for __TARGET_ARCH_arm64. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260513045204.2403441-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-13bpf, arm64: Map BPF_REG_0 to x8 instead of x7Puranjay Mohan
Move the BPF return value register from x7 to x8, freeing x7 for use as an argument register. AAPCS64 designates x8 as the indirect result location register; it is caller-saved and not used for argument passing, making it a suitable home for BPF_REG_0. This is a prerequisite for stack argument support, which needs x5-x7 to pass arguments 6-8 to native kfuncs following the AAPCS64 calling convention. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260513045153.2402197-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-13selftests/bpf: Add precision backtracking test for stack argumentsYonghong Song
Add a test that verifies precision backtracking works correctly across BPF-to-BPF calls when stack arguments are involved. The test passes a size value as incoming stack arg (arg6) to a subprog, which forwards it as the mem__sz parameter (outgoing arg7) to bpf_kfunc_call_stack_arg_mem. The expected __msg annotations verify that precision propagates from the kfunc's mem__sz argument back through the subprog frame to the caller's outgoing stack arg store. A companion BTF file (btf__stack_arg_precision.c) provides named parameter BTF for the __naked subprog via __btf_func_path. Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260513045148.2400087-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-13selftests/bpf: Add verifier tests for stack argument validationYonghong Song
Add inline-asm based verifier tests that exercise stack argument validation logic directly. Positive tests: - subprog call with 6 arg's - Two sequential calls to different subprogs (6-arg and 7-arg) - Share a r11 store for both branches Negative tests — verifier rejection: - Read from uninitialized incoming stack arg slot - Gap in outgoing slots: only r11-16 written, r11-8 missing - Write at r11-80, exceeding max 7 stack args - Missing store on one branch with a shared store - First call has proper stack arguments and the second call intends to inherit stack arguments but not working - r11 load ordering issue Negative tests — pointer/ref tracking: - Pruning type mismatch: one branch stores PTR_TO_STACK, the other stores a scalar, callee dereferences — must not prune - Release invalidation: bpf_sk_release invalidates a socket pointer stored in a stack arg slot - Packet pointer invalidation: bpf_skb_pull_data invalidates a packet pointer stored in a stack arg slot - Null propagation: PTR_TO_MAP_VALUE_OR_NULL stored in stack arg slot, null branch attempts dereference via callee Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260513045143.2399278-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-13selftests/bpf: Add BTF fixup for __naked subprog parameter namesYonghong Song
When __naked subprogs are used in verifier tests, clang drops parameter names from their BTF FUNC_PROTO entries. This prevents the verifier from resolving stack argument slots by name. Add a __btf_func_path(path) annotation that points to a separate BTF file containing properly-named FUNC entries. The test_loader matches FUNC entries by name, detects anonymous parameters, and replaces the FUNC_PROTO with a new one that carries parameter names from the custom file while preserving the original type IDs. The custom BTF file also serves as btf_custom_path for kfunc resolution when no separate btf_custom_path is specified. Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260513045138.2398886-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-13selftests/bpf: Add tests for stack argument validationYonghong Song
Add negative tests that verify the kfunc (rejecting kfunc call with >8 byte struct as stack argument) and the verifier (rejecting invalid uses of r11 for stack arguments). Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260513045132.2398371-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-13selftests/bpf: Add tests for BPF function stack argumentsYonghong Song
Add selftests covering stack argument passing for both BPF-to-BPF subprog calls and kfunc calls with more than 5 arguments. All tests are guarded by __BPF_FEATURE_STACK_ARGUMENT and __TARGET_ARCH_x86. BPF-to-BPF subprog call tests (stack_arg.c): - Scalar stack args - Pointer stack args - Mixed pointer/scalar stack args - Nested calls - Dynptr stack arg - Two callees with different stack arg counts - Async callback Kfunc call tests (stack_arg_kfunc.c, with bpf_testmod kfuncs): - Scalar stack args - Pointer stack args - Mixed pointer/scalar stack args - Dynptr stack arg - Memory buffer + size pair - Iterator - Const string pointer - Timer pointer Acked-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20260513045127.2397187-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-13selftests: ublk: cap nthreads to kernel's actual nr_hw_queuesMing Lei
dev->nthreads is derived from the user-requested queue count before the ADD command, but the kernel may reduce nr_hw_queues (capped to nr_cpu_ids). When the VM has fewer CPUs than requested queues, the daemon creates more handler threads than there are kernel queues. In non-batch mode, the extra threads access uninitialized queues (q_depth=0), submit zero io_uring SQEs, and block forever in io_cqring_wait. In batch mode, the extra threads cause similar hangs during device removal. In both cases, the stuck threads prevent the daemon from closing the char device, holding the last ublk_device reference and causing ublk_ctrl_del_dev() to hang in wait_event_interruptible(). Fix by capping dev->nthreads to the kernel-returned nr_hw_queues after the ADD command completes. per_io_tasks mode is excluded because threads interleave across all queues, so nthreads > nr_hw_queues is valid. Fixes: abe54c160346 ("selftests: ublk: kublk: decouple ublk_queues from ublk server threads") Signed-off-by: Ming Lei <tom.leiming@gmail.com> Link: https://patch.msgid.link/20260513101941.1373998-1-tom.leiming@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-05-12selftests: drv-net: cope with slow env in so_txtime.py testWillem de Bruijn
This test was converted from shell script to drv-net test. The new version is flaky in dbg builds on the netdev.bots dashboard. The previous shell script had more protections to avoid these. Added in commit a7ee79b9c455 ("selftests: net: cope with slow env in so_txtime.sh test"). Add the same overall protection: - Suppress so_txtime process failure if KSFT_MACHINE_SLOW Also relax two timeouts to reduce the number of process failures themselves - Increase SO_RCVTIMEO to 2 seconds - Increase process start-up stabilization to 2 seconds Delays were experimentally arrived at while running with vng built with kernel/configs/debug.config Fixes: 5c6baef3885c ("selftests: drv-net: convert so_txtime to drv-net") Reported-by: Jakub Kicinski <kuba@kernel.org> Closes: https://lore.kernel.org/netdev/20260510174219.74aeee6d@kernel.org/ Signed-off-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260511222138.2045551-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-12KVM: selftests: Ensure gmem file sizes are multiple of host page sizeSean Christopherson
When creating a guest_memfd file and associated memslot to validate shared guest memory, size the file+memslot to the maximum of the host or guest page size. Attempting to allocate a single guest page will fail if the host page size is greater than the guest page size, as KVM requires that the size of memslots and guest_memfd files are a multiple of the host page size. For simplicity, verify the entire file can be shared between guest and host, e.g. instead of trying to validate "partial" mappings. Fixes: 42188667be38 ("KVM: selftests: Add guest_memfd testcase to fault-in on !mmap()'d memory") Reported-by: Zenghui Yu <zenghui.yu@linux.dev> Closes: https://lore.kernel.org/all/0064952b-048c-455d-ad89-e27e5cb82591@linux.dev Signed-off-by: Sean Christopherson <seanjc@google.com> Message-ID: <20260512155634.772602-1-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-05-12selftests/bpf: Add tests to verify map create failure logLeon Hwang
Add tests to verify that the kernel reports the expected error messages and correct log_true_size when map creation fails. Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/r/20260512153157.28382-9-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-12selftests/cgroup: check malloc return value in alloc_anon functionsHongfu Li
The alloc_anon() function calls malloc() without checking for a NULL return. If memory allocation fails, a NULL pointer dereference will occur when accessing the buffer. Add proper error handling to return -1 when malloc() fails in all four alloc_anon variants: - alloc_anon() - alloc_anon_50M_check() - alloc_anon_noexit() - alloc_anon_50M_check_swap() Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Reviewed-by: Vishal Moola <vishal.moola@gmail.com> Reviewed-by: Muchun Song <muchun.song@linux.dev> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-12selftests: drv-net: add shaper test for duplicate leavesJakub Kicinski
Add test exercising duplicate leaves. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20260510192904.3987113-5-kuba@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-11selftests: mptcp: pm: use simpler send/recv formsMatthieu Baerts (NGI0)
Instead of sendto() and recvfrom() which the NL address that was already provided before. Just simpler and easier to read without the to/from variants. While at it, fix a checkpatch warning by removing multiple assignments. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260508-net-next-mptcp-pm-inc-limits-v1-8-c84e3fdf9b6a@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-11selftests: mptcp: pm: validate new limitsMatthieu Baerts (NGI0)
These limits have been recently updated, from 8 to: - 64 for the subflows and accepted add_addr - 255 for the MPTCP endpoints These modifications validate the new limits, but are also compatible with the previous ones, to be able to continue to validate stable kernel using the last version of the selftests. That's why new variables are now used instead of hard-coded values. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260508-net-next-mptcp-pm-inc-limits-v1-7-c84e3fdf9b6a@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-11selftests: mptcp: join: validate 8x8 subflowsMatthieu Baerts (NGI0)
The limits have been recently increased, it is required to validate that having 64 subflows is allowed. Here, both the client and the server have 8 network interfaces. The server has 8 endpoints marked as 'signal' to announce all its v4 addresses. The client also has 8 endpoints, but marked as 'subflow' and 'fullmesh' in order to create 8 subflows to each address announced by the server. This means 63 additional subflows will be created after the initial one. If it is not possible to increase the limits to 64, it means an older kernel version is being used, and the test is skipped. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260508-net-next-mptcp-pm-inc-limits-v1-6-c84e3fdf9b6a@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-11selftests: mptcp: join: allow changing ifaces nr per testMatthieu Baerts (NGI0)
By default, 4 network interfaces are created per subtest in a dedicated net namespace. Each netns has a dedicated pair of v4 and v6 addresses. Future tests will need more. Simply always creating more network interfaces per test will increase the execution time for all other tests, for no other benefits. So now it is possible to change this number only when needed, by setting ifaces_nr when calling 'reset' and 'init_shapers', e.g. ifaces_nr=8 reset "Subtest title" ifaces_nr=8 init_shapers Note that it might also be interesting to decrease the default value to 2 to reduce the setup time, especially when a debug kernel config is being used. Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260508-net-next-mptcp-pm-inc-limits-v1-5-c84e3fdf9b6a@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-11selftests/bpf: Use both hrtimer enqueue helpers in vmlinux testIhor Solodrai
The vmlinux selftest triggers nanosleep and checks that both kprobe and fentry programs observe the hrtimer enqueue path. After the hrtimer_start_expires_user() conversion [1], nanosleep reaches hrtimer_start_range_ns_user() instead of hrtimer_start_range_ns(). Hard-coding either symbol makes the test fail either on bpf tree or on linux-next [2]. Update the test to resolve the target symbol at runtime via libbpf_find_vmlinux_btf_id(). This is a nice example of how to modify a BPF program to work on both older and newer kernel revision. [1] https://lore.kernel.org/all/20260408114952.062400833@kernel.org/ [2] https://github.com/kernel-patches/bpf/actions/runs/25485909958/job/74782902203 Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/r/20260509005730.250956-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11Merge branch 'for-7.1-fixes' into for-7.2Tejun Heo
Pull to receive: 9a415cc53711 ("sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path") Conflicts with for-7.2's scx_task_iter_relock() rework. The fix moves put_task_struct(p) past scx_error(); for-7.2 still has it at the old position. Resolved by dropping the old one. Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-11selftests/bpf: Add XDP load-balancer benchmark run scriptPuranjay Mohan
Add a convenience script that runs all 24 XDP load-balancer scenarios and formats the results as a table with median, stddev, and p99 columns. ./benchs/run_bench_xdp_lb.sh Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-8-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add XDP load-balancer benchmark driverPuranjay Mohan
Wire up the userspace side of the XDP load-balancer benchmark. 24 scenarios cover the full code-path matrix: TCP/UDP, IPv4/IPv6, cross-AF encap, LRU hit/miss/diverse/cold, consistent-hash bypass, SYN/RST flag handling, and early exits (unknown VIP, non-IP, ICMP, fragments, IP options). Before benchmarking each scenario validates correctness: the output packet is compared byte-for-byte against a pre-built expected packet and BPF map counters are checked against the expected values. Usage: sudo ./bench -a -w3 -p1 xdp-lb --scenario tcp-v4-lru-hit sudo ./bench xdp-lb --list-scenarios Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-7-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add XDP load-balancer BPF programPuranjay Mohan
Add the BPF datapath for the XDP load-balancer benchmark, a simplified L4 load-balancer inspired by katran. The pipeline: L3/L4 parse -> VIP lookup -> per-CPU LRU connection table or consistent-hash fallback -> real server lookup -> per-VIP and per-real stats -> IPIP/IP6IP6 encapsulation. TCP SYN forces the consistent-hash path (skipping LRU); TCP RST skips LRU insert to avoid polluting the table. process_packet() is marked __noinline so that the BENCH_BPF_LOOP reset block (which strips encapsulation) operates on valid packet pointers after bpf_xdp_adjust_head(). Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-6-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add XDP load-balancer common definitionsPuranjay Mohan
Add the shared header for the XDP load-balancer benchmark. This defines the data structures used by both the BPF program and userspace: flow_key, vip_definition, real_definition, and the stats/control structures. Also provides the encapsulation source-address helpers shared between the BPF datapath (for encap) and userspace (for building expected output packets used in validation). Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-5-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add bpf-nop benchmark for timing overhead baselinePuranjay Mohan
Add a minimal benchmark that measures the overhead of the batch-timing infrastructure itself. The BPF program runs an empty BENCH_BPF_LOOP body (~1.5-2 ns/op), establishing the floor cost that all timing-library benchmarks include. [root@virtme-ng tools/testing/selftests/bpf]# sudo ./bench -a -p8 bpf-nop Setting up benchmark 'bpf-nop'... Benchmark 'bpf-nop' started. bpf-nop: median 1.82 ns/op, stddev 0.01, p99 1.86 (1754 samples) Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-4-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add BPF batch-timing libraryPuranjay Mohan
Add a reusable timing library for BPF benchmarks that need to measure BPF program execution time. The BPF side (progs/bench_bpf_timing.bpf.h) provides per-CPU sample arrays and BENCH_BPF_LOOP(), a macro that brackets batch_iters iterations with bpf_ktime_get_ns() reads and records the elapsed time. One extra untimed iteration runs afterward for output validation. The userspace side (benchs/bench_bpf_timing.c) collects samples from the skeleton BSS, computes percentile statistics, and auto-calibrates batch_iters to target ~10 ms per batch. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add bench_force_done() for early benchmark completionPuranjay Mohan
The bench framework waits for duration_sec to elapse before collecting results. Benchmarks that know exactly how many samples they need can call bench_force_done() to signal completion early, avoiding wasted wall-clock time. Also refactor collect_measurements() to reuse bench_force_done() instead of open-coding the same mutex/cond_signal sequence. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20260427232313.1582588-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/bpf: Add test for large offset bpf-to-bpf callYazhou Tang
Add a selftest to verify the verifier and JIT behavior when handling bpf-to-bpf calls with relative jump offsets exceeding the s16 boundary. The test utilizes an inline assembly block with ".rept 32765" to generate a massive dummy subprogram. By placing this padding between the main program and the target subprogram, it forces the verifier to process a bpf-to-bpf call where the imm field exceeds the s16 range. - When JIT is enabled, it asserts that the program is successfully loaded and executes correctly to return the expected value. Since the fix does not change the JIT behavior, the test passes whether the fix is applied or not. - When JIT is disabled, it also asserts that the program is successfully loaded and executes correctly to return the expected value 3. - Before the fix, the verifier rewrites the call instruction with a truncated offset (here 32768 -> -32768) and lets it pass. When the program is executed, the call instruction will go to a wrong target (the landing pad) instead of the intended subprogram, then return -1 and fail. - After the fix, the verifier correctly handles the large offset and allows it to pass. The program then executes correctly to return the expected value 3. Co-developed-by: Tianci Cao <ziye@zju.edu.cn> Signed-off-by: Tianci Cao <ziye@zju.edu.cn> Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com> Acked-by: Xu Kuohai <xukuohai@huawei.com> Link: https://lore.kernel.org/r/20260506094714.419842-4-tangyazhou@zju.edu.cn Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-11selftests/namespaces: Skip efault tests when listns() is not availableRicardo B. Marlière
When listns() is not implemented the iterator child detects ENOSYS and exits cleanly with status PIDFD_SKIP before the parent has a chance to signal it. The parent sends SIGKILL (which is a harmless no-op at that point) and then calls waitpid(), obtaining a normal-exit status. The subsequent ASSERT_TRUE(WIFSIGNALED(status)) therefore fails, causing the three EFAULT-focused tests to report FAIL rather than SKIP on kernels that do not yet carry listns() support. After collecting the iterator's exit status, check whether it exited with PIDFD_SKIP and issue a SKIP verdict in that case, consistent with the behaviour of every other listns test that already handles ENOSYS correctly. Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Link: https://patch.msgid.link/20260407-selftests-namespaces_fixes-v1-3-59109909d88b@suse.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-05-11selftests/namespaces: Fix waitpid race in listns_efault_test cleanupRicardo B. Marlière
The efault tests spawn two categories of child processes: namespace children (each in its own mount namespace, for concurrent destruction) and an iterator child that calls listns() in a tight loop. The cleanup loop used waitpid(-1), which reaps any child in any order. If the iterator child exits early (e.g. because listns() returned ENOSYS) before all namespace children have been reaped, waitpid(-1) may consume it instead. The subsequent targeted waitpid(iter_pid) would then block indefinitely. Track the PIDs of the namespace children explicitly and use targeted waitpid() calls in the cleanup loop so the iterator child cannot be inadvertently reaped during namespace cleanup. Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Link: https://patch.msgid.link/20260407-selftests-namespaces_fixes-v1-2-59109909d88b@suse.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-05-11selftests/namespaces: Kill grandchild in nsid fixture teardownRicardo B. Marlière
The timens_separate and pidns_separate test cases fork a grandchild that calls pause(). FIXTURE_TEARDOWN only kills the direct child, which is the init process of the grandchild's namespace. Once the child (init) exits, the grandchild is reparented to the host init but remains alive and continues to hold the inherited write end of the test runner's TAP pipe open. tap_prefix never receives EOF and blocks indefinitely, hanging the entire test collection. Record the grandchild PID in the fixture struct so that teardown can send SIGKILL and reap it before dealing with the child. The grandchild must be reaped first because the child acts as its PID namespace init; killing the child first would kill the grandchild without giving us a chance to waitpid() it. Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Link: https://patch.msgid.link/20260407-selftests-namespaces_fixes-v1-1-59109909d88b@suse.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-05-11selftests/pid_namespace: compute pid_max test limits dynamicallyBjoern Doebel
The pid_max kselftest hardcodes pid_max values of 400 and 500, but the kernel enforces a minimum of PIDS_PER_CPU_MIN * num_possible_cpus(). On machines with many possible CPUs (e.g. nr_cpu_ids=128 yields a minimum of 1024), writing 400 or 500 to /proc/sys/kernel/pid_max returns EINVAL and all three tests fail. Compute these limits the same way as the kernel does and set outer_limit and inner_limit dynamically based on the result. Original test semantics are preserved (outer < inner, nested namespace capped by parent). Signed-off-by: Bjoern Doebel <doebel@amazon.com> Link: https://patch.msgid.link/20260422201151.3830506-1-doebel@amazon.com Reviewed-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> Assisted-by: Kiro:claude-opus-4.6 Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-05-10Merge branch 'for-7.1-fixes' into for-7.2Tejun Heo
Pull to receive dde2f938d02f ("cgroup/cpuset: move PF_EXITING check before __GFP_HARDWALL in cpuset_current_node_allowed()") as a dependency for an upcoming patch in the same function. Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10selftests/cgroup: fix misleading debug message in test_cgfreezer_time_childTao Cui
The debug message says "Expect ctime <= ptime" when the test actually expects ctime > ptime (child's freeze time should exceed parent's, which is zero). Fix the message to match the actual expectation. Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10selftests/cgroup: fix child process escaping to parent cleanup in ↵Tao Cui
test_cpucg_nice In test_cpucg_nice, the forked child process incorrectly jumps to the parent's cleanup label on cg_write failure. This causes the child to attempt cg_destroy on cgroups the parent is still using, and then return to main() to continue executing tests as if it were the parent. Replace goto cleanup with exit(EXIT_FAILURE) in the child process. Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10selftests/cgroup: Add NULL check after malloc in cgroup_util.cHongfu Li
Add NULL checks after malloc() in three helper functions to prevent NULL pointer dereference on memory allocation failure. - cg_name() - cg_name_indexed() - cg_control() These functions allocate memory with malloc() but previously called snprintf() unconditionally, which would trigger undefined behavior if allocation fails. Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10selftests/sched_ext: Fix build error in dequeue selftestAndrea Righi
Building the dequeue selftest with newer compilers (e.g., gcc 16) triggers the following error: dequeue.c:28:22: error: variable 'sum' set but not used The 'volatile' qualifier prevents the writes from being optimized away, but does not silence the unused variable 'sum' is indeed only written and never read. Consume 'sum' via an empty asm() with a register input constraint. This forces the compiler to keep the accumulated value (preserving the CPU stress loop) and avoiding the build error. Fixes: 658ad2259b3e ("selftests/sched_ext: Add test to validate ops.dequeue() semantics") Signed-off-by: Andrea Righi <arighi@nvidia.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10selftests/cgroup: Fix string comparison in write_testHongfu Li
Use string comparison (!=) instead of numeric comparison (-ne) for cpuset values like "0-1". For example: $ [[ "0-1" != "2-3" ]] && echo "true" || echo "false" true $ [[ "0-1" -ne "2-3" ]] && echo "true" || echo "false" false Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10selftests/cgroup: Fix cg_read_strcmp() empty string comparisonHongfu Li
cg_read_strcmp() allocated a buffer sized to strlen(expected) + 1, then passed it to read_text() which calls read(fd, buf, size-1). When comparing against an empty string (""), strlen("") = 0 gives a 1-byte buffer, and read() is asked to read 0 bytes. The file content is never actually read, so strcmp("", buf) always returns 0 regardless of the real content. This caused cg_test_proc_killed() to always report the cgroup as empty immediately, making OOM tests pass without verifying that processes were killed. Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-10Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.1-rc3Alexei Starovoitov
Cross-merge BPF and other fixes after downstream PR. Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-10selftests: rds: Disarm signal alarm on test completionAllison Henderson
A race in stop_pcaps is possible if the test completes and then times out while waiting for the tcpdump process to exit. The signal handler may fire again and needlessly call stop_pcap a second time. Fix this by disabling the alarm after normal test completion. Also if there are no tcpdump processes to wait on, stop_pcaps can just exit. This avoids misleading prints when there are no procs to collect dumps from. Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260507233213.556182-4-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10selftests: rds: Fix TAP-prefixed prints in check_gcov*Allison Henderson
This patch adds the # prefix to info and warning prints in the check_gcov* routines. Since these routines do not exit, as the other check_* routines do, the output here should be kept TAP compliant. Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260507233213.556182-3-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10selftests: rds: Fix stale log clean upAllison Henderson
Since rds self tests no longer has a default folder, users must specify a log collection folder if they want to collect logs. Currently the log folder is deleted and recreated, but this can be dangerous if the user exports RDS_LOG_DIR=/tmp or /var/log. This patch corrects the clean up to delete only rds log artifacts from the log folder, and further prefixes rds specific logs as rds* Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260507233213.556182-2-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10selftests: net: getsockopt_iter: cleanupBreno Leitao
Apply two cleanups suggested by Stanislav and bobby on the original selftest series: - Reorder local variable declarations into reverse christmas-tree order (longest line first). Because that ordering puts socklen_t optlen before the variable whose size it stores, the "optlen = sizeof(...)" initializer is moved out of the declaration to a plain assignment in the test body, as Stanislav suggested. - Add ASSERT_EQ(optlen, ...) on every error path so the value the kernel writes back to the userspace optlen is pinned down even when the syscall returns -1. With do_sock_getsockopt() now writing opt->optlen back to userspace unconditionally, asserting that the netlink/vsock error paths leave the original input length untouched guards against future regressions. Bobby Eshleman pointed out that SO_VM_SOCKETS_CONNECT_TIMEOUT_NEW/OLD return a sock_timeval-shaped payload (16 bytes on 64-bit), which is wider than the u64 case already covered. Add four tests that exercise this path: - connect_timeout_new_exact exact-size buffer - connect_timeout_new_oversize_clamped oversize buffer, clamped - connect_timeout_new_undersize undersize -> -EINVAL, optlen untouched - connect_timeout_old_exact exact-size buffer for OLD optname Suggested-by: Stanislav Fomichev <sdf@fomichev.me> Suggested-by: Bobby Eshleman <bobbyeshleman@meta.com> Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260507-getsock_two-v2-5-5873111d9c12@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-09Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull bpf fixes from Alexei Starovoitov: - Fix sk_local_storage diag dump via netlink (Amery Hung) - Fix off-by-one in arena direct-value access (Junyoung Jang) - Reject TCP_NODELAY in bpf-tcp congestion control (KaFai Wan) - Fix type confusion in bpf_*_sock() (Kuniyuki Iwashima) - Reject TX-only AF_XDP sockets (Linpu Yu) - Don't run arg-tracking analysis twice on main subprog (Paul Chaignon) - Fix NULL pointer dereference in bpf_sk_storage_clone and fib lookup (Weiming Shi) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix off-by-one boundary validation in arena direct-value access xskmap: reject TX-only AF_XDP sockets bpf: Don't run arg-tracking analysis twice on main subprog bpf: Free reuseport cBPF prog after RCU grace period. bpf: tcp: Fix type confusion in sol_tcp_sockopt(). bpf: tcp: Fix type confusion in bpf_skc_to_tcp6_sock(). bpf: tcp: Fix type confusion in bpf_skc_to_tcp_sock(). mptcp: bpf: Fix type confusion in bpf_mptcp_sock_from_subflow() selftest: bpf: Add test for bpf_tcp_sock() and RAW socket. bpf: tcp: Fix type confusion in bpf_tcp_sock(). tools/headers: Regenerate stddef.h to fix BPF selftests bpf: Fix sk_local_storage diag dumping uninitialized special fields bpf: Fix NULL pointer dereference in bpf_skb_fib_lookup() sockmap: Fix sk_psock_drop() race vs sock_map_{unhash,close,destroy}(). bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths selftests/bpf: Verify bpf-tcp-cc rejects TCP_NODELAY selftests/bpf: Test TCP_NODELAY in TCP hdr opt callbacks bpf: Reject TCP_NODELAY in bpf-tcp-cc bpf: Reject TCP_NODELAY in TCP header option callbacks
2026-05-08Merge tag 'sched-urgent-2026-05-09' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: - Fix spurious failures in rseq self-tests (Mark Brown) - Fix rseq rseq::cpu_id_start ABI regression due to TCMalloc's creative use of the supposedly read-only field The fix is to introduce a new ABI variant based on a new (larger) rseq area registration size, to keep the TCMalloc use of rseq backwards compatible on new kernels (Thomas Gleixner) - Fix wakeup_preempt_fair() for not waking up task (Vincent Guittot) - Fix s64 mult overflow in vruntime_eligible() (Zhan Xusheng) * tag 'sched-urgent-2026-05-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Fix wakeup_preempt_fair() for not waking up task sched/fair: Fix overflow in vruntime_eligible() selftests/rseq: Expand for optimized RSEQ ABI v2 rseq: Reenable performance optimizations conditionally rseq: Implement read only ABI enforcement for optimized RSEQ V2 mode selftests/rseq: Validate legacy behavior selftests/rseq: Make registration flexible for legacy and optimized mode selftests/rseq: Skip tests if time slice extensions are not available rseq: Revert to historical performance killing behaviour rseq: Don't advertise time slice extensions if disabled rseq: Protect rseq_reset() against interrupts rseq: Set rseq::cpu_id_start to 0 on unregistration selftests/rseq: Don't run tests with runner scripts outside of the scripts
2026-05-08selftests: net: Add protodown testsIdo Schimmel
Add a selftest for the protodown mechanism. Five test cases are included: 1. Basic protodown toggling: Verify that setting protodown on macvlan results in DOWN operational state and clearing it restores UP. 2. Same as the previous test case, but with vxlan. 3. Protodown reasons: Verify that protodown cannot be cleared while there are active protodown reasons, but can be cleared once all reasons are removed. 4. Protodown with lower device being toggled: Verify that toggling the lower device's carrier while protodown is on does not cause the macvlan to gain carrier. 5. Protodown with lower device down: Verify that toggling protodown while the lower device has no carrier does not cause the macvlan to gain carrier. Note that the last two test cases fail without "net: Do not turn on carrier when protodown is on" and "net: Do not unconditionally turn on carrier when turning off protodown": # ./protodown.sh TEST: Basic protodown on/off with macvlan [ OK ] TEST: Basic protodown on/off with vxlan [ OK ] TEST: Protodown reasons [ OK ] TEST: Protodown with lower device toggled [FAIL] Macvlan operational state is not DOWN despite protodown TEST: Protodown with lower device down [FAIL] Macvlan is not LOWERLAYERDOWN after clearing protodown Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260507105906.891817-5-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-11 12:35:37 +0000