From: Werner Kasselman <werner@verivus.ai>
To: "bpf@vger.kernel.org" <bpf@vger.kernel.org>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>
Cc: Werner Kasselman <werner@verivus.ai>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
Martin KaFai Lau <martin.lau@linux.dev>,
Eduard Zingerman <eddyz87@gmail.com>, Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
John Fastabend <john.fastabend@gmail.com>,
KP Singh <kpsingh@kernel.org>,
Stanislav Fomichev <sdf@fomichev.me>, Hao Luo <haoluo@google.com>,
Jiri Olsa <jolsa@kernel.org>, Shuah Khan <shuah@kernel.org>,
"open list:KERNEL SELFTEST FRAMEWORK"
<linux-kselftest@vger.kernel.org>,
open list <linux-kernel@vger.kernel.org>
Subject: [PATCH bpf v4 2/2] selftests/bpf: cover same-reg sock_ops rtt_min request_sock access
Date: Mon, 20 Apr 2026 22:16:28 +0000 [thread overview]
Message-ID: <20260420221621.1441707-3-werner@verivus.com> (raw)
In-Reply-To: <20260420221621.1441707-1-werner@verivus.com>
Add a tcpbpf sock_ops selftest that forces a same-register
ctx->rtt_min read on request_sock-backed callbacks and verifies the
observed value is zero.
This covers the dst_reg == src_reg path that the previous
ctx_rewrite-only test did not exercise.
Signed-off-by: Werner Kasselman <werner@verivus.com>
---
.../testing/selftests/bpf/prog_tests/tcpbpf_user.c | 4 ++++
.../testing/selftests/bpf/progs/test_tcpbpf_kern.c | 14 ++++++++++++++
tools/testing/selftests/bpf/test_tcpbpf.h | 2 ++
3 files changed, 20 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/tcpbpf_user.c b/tools/testing/selftests/bpf/prog_tests/tcpbpf_user.c
index 7e8fe1bad03f..1b08e49327d0 100644
--- a/tools/testing/selftests/bpf/prog_tests/tcpbpf_user.c
+++ b/tools/testing/selftests/bpf/prog_tests/tcpbpf_user.c
@@ -42,6 +42,10 @@ static void verify_result(struct tcpbpf_globals *result)
/* check getsockopt for window_clamp */
ASSERT_EQ(result->window_clamp_client, 9216, "window_clamp_client");
ASSERT_EQ(result->window_clamp_server, 9216, "window_clamp_server");
+
+ /* check same-reg rtt_min read on request_sock-backed callbacks */
+ ASSERT_NEQ(result->rtt_min_req_seen, 0, "rtt_min_req_seen");
+ ASSERT_EQ(result->rtt_min_req_nonzero, 0, "rtt_min_req_nonzero");
}
static void run_test(struct tcpbpf_globals *result)
diff --git a/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c b/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
index 6935f32eeb8f..a488b282b5dd 100644
--- a/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_tcpbpf_kern.c
@@ -33,6 +33,7 @@ int bpf_testcb(struct bpf_sock_ops *skops)
{
char header[sizeof(struct ipv6hdr) + sizeof(struct tcphdr)];
struct bpf_sock_ops *reuse = skops;
+ long rtt_min = (long)skops;
struct tcphdr *thdr;
int window_clamp = 9216;
int save_syn = 1;
@@ -84,6 +85,19 @@ int bpf_testcb(struct bpf_sock_ops *skops)
global.event_map |= (1 << op);
+ if (!skops->is_fullsock &&
+ (op == BPF_SOCK_OPS_RWND_INIT || op == BPF_SOCK_OPS_NEEDS_ECN)) {
+ asm volatile (
+ "%[rtt_min] = *(u32 *)(%[rtt_min] + %[rtt_min_off]);\n"
+ : [rtt_min] "+r"(rtt_min)
+ : [rtt_min_off] "i"(offsetof(struct bpf_sock_ops, rtt_min))
+ :);
+
+ global.rtt_min_req_seen = 1;
+ if (rtt_min)
+ global.rtt_min_req_nonzero = 1;
+ }
+
switch (op) {
case BPF_SOCK_OPS_TCP_CONNECT_CB:
rv = bpf_setsockopt(skops, SOL_TCP, TCP_WINDOW_CLAMP,
diff --git a/tools/testing/selftests/bpf/test_tcpbpf.h b/tools/testing/selftests/bpf/test_tcpbpf.h
index 9dd9b5590f9d..e9806215cbc0 100644
--- a/tools/testing/selftests/bpf/test_tcpbpf.h
+++ b/tools/testing/selftests/bpf/test_tcpbpf.h
@@ -18,5 +18,7 @@ struct tcpbpf_globals {
__u32 tcp_saved_syn;
__u32 window_clamp_client;
__u32 window_clamp_server;
+ __u32 rtt_min_req_seen;
+ __u32 rtt_min_req_nonzero;
};
#endif
--
2.43.0
next prev parent reply other threads:[~2026-04-20 22:16 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-17 2:31 [PATCH bpf v3 0/2] bpf: fix sock_ops rtt_min OOB read Werner Kasselman
2026-04-17 2:31 ` [PATCH 1/2] bpf: extract SOCK_OPS_LOAD_TCP_SOCK_FIELD from SOCK_OPS_GET_FIELD Werner Kasselman
2026-04-17 2:31 ` [PATCH 2/2] bpf: guard sock_ops rtt_min against non-locked tcp_sock Werner Kasselman
2026-04-20 20:43 ` Martin KaFai Lau
2026-04-20 22:16 ` [PATCH bpf v4 0/2] " Werner Kasselman
2026-04-20 22:16 ` [PATCH bpf v4 1/2] " Werner Kasselman
2026-04-20 22:16 ` Werner Kasselman [this message]
2026-04-20 23:00 ` [PATCH bpf v5 0/2] " Werner Kasselman
2026-04-20 23:00 ` [PATCH bpf v5 1/2] " Werner Kasselman
2026-04-22 21:03 ` Martin KaFai Lau
2026-04-20 23:00 ` [PATCH bpf v5 2/2] selftests/bpf: cover same-reg sock_ops rtt_min request_sock access Werner Kasselman
2026-04-22 21:11 ` Martin KaFai Lau
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260420221621.1441707-3-werner@verivus.com \
--to=werner@verivus.ai \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=netdev@vger.kernel.org \
--cc=sdf@fomichev.me \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.