[PATCH bpf-next v1] selftests/bpf: Add test for indirect struct_ops trampoline

[PATCH bpf-next v1] selftests/bpf: Add test for indirect struct_ops trampoline

[Tiezhu Yang]

Add a test case to verify that arguments passed on the stack are correctly
read by indirect struct_ops trampoline. This test ensures the correctness
of stack offsets on architectures like LoongArch and RISC-V.

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
---
This is to test the following two patches:

bpf, riscv: Fix stack-passed arguments for indirect trampolines
https://lore.kernel.org/bpf/20260821233516.3426127-3-memxor@gmail.com/

bpf, loongarch: Fix stack arguments for indirect trampolines
https://lore.kernel.org/bpf/20260821233516.3426127-8-memxor@gmail.com/

 .../prog_tests/test_struct_ops_trampoline.c   | 41 +++++++++++++++++++
 .../bpf/progs/struct_ops_trampoline.c         | 24 +++++++++++
 .../selftests/bpf/test_kmods/bpf_testmod.c    | 18 ++++++++
 .../selftests/bpf/test_kmods/bpf_testmod.h    |  5 +++
 4 files changed, 88 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c
 create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_trampoline.c

diff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c
new file mode 100644
index 000000000000..5a21aedd02fc
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <test_progs.h>
+#include "struct_ops_trampoline.skel.h"
+
+#if defined(__loongarch__) || defined(__riscv)
+static void run_struct_ops_trampoline(void)
+{
+	struct struct_ops_trampoline *skel;
+	struct bpf_link *link;
+	int err;
+
+	skel = struct_ops_trampoline__open();
+	if (!ASSERT_OK_PTR(skel, "struct_ops_trampoline__open"))
+		return;
+
+	err = struct_ops_trampoline__load(skel);
+	if (!ASSERT_OK(err, "struct_ops_trampoline__load"))
+		goto cleanup;
+
+	link = bpf_map__attach_struct_ops(skel->maps.testmod_trampoline);
+	if (!ASSERT_OK_PTR(link, "attach_struct_ops"))
+		goto cleanup;
+
+	ASSERT_OK(trigger_module_test_read(256), "trigger_read");
+
+	ASSERT_EQ(skel->bss->got_arg9, 9999, "check_stack_passed_arg9");
+
+	bpf_link__destroy(link);
+cleanup:
+	struct_ops_trampoline__destroy(skel);
+}
+#endif
+
+void test_struct_ops_trampoline(void)
+{
+#if defined(__loongarch__) || defined(__riscv)
+	run_struct_ops_trampoline();
+#else
+	test__skip();
+#endif
+}
diff --git a/tools/testing/selftests/bpf/progs/struct_ops_trampoline.c b/tools/testing/selftests/bpf/progs/struct_ops_trampoline.c
new file mode 100644
index 000000000000..b0fc19a2a0c5
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/struct_ops_trampoline.c
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <vmlinux.h>
+#include <bpf/bpf_tracing.h>
+#include "../test_kmods/bpf_testmod.h"
+#include "bpf_misc.h"
+
+char _license[] SEC("license") = "GPL";
+
+__u64 got_arg9 = 0;
+
+SEC("struct_ops/test_trampoline")
+int BPF_PROG(test_trampoline, int arg1, int arg2, int arg3,
+			      int arg4, int arg5, int arg6,
+			      int arg7, int arg8, int arg9)
+{
+	got_arg9 = arg9;
+
+	return 0;
+}
+
+SEC(".struct_ops.link")
+struct bpf_testmod_ops testmod_trampoline = {
+	.test_trampoline = (void *)test_trampoline,
+};
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
index 850cf4f830c4..be96bbc1b7c0 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
@@ -589,6 +589,9 @@ noinline int bpf_testmod_trampoline_count_test(void)
 	return 0;
 }
 
+struct bpf_testmod_ops;
+static struct bpf_testmod_ops *st_ops_trampoline;
+
 noinline ssize_t
 bpf_testmod_test_read(struct file *file, struct kobject *kobj,
 		      const struct bin_attribute *bin_attr,
@@ -637,6 +640,9 @@ bpf_testmod_test_read(struct file *file, struct kobject *kobj,
 
 	bpf_testmod_test_struct_ops3();
 
+	if (st_ops_trampoline && st_ops_trampoline->test_trampoline)
+		st_ops_trampoline->test_trampoline(1, 2, 3, 4, 5, 6, 7, 8, 9999);
+
 	struct_arg3 = kmalloc((sizeof(struct bpf_testmod_struct_arg_3) +
 				sizeof(int)), GFP_KERNEL);
 	if (struct_arg3 != NULL) {
@@ -1619,6 +1625,10 @@ static int bpf_testmod_ops_init_member(const struct btf_type *t,
 		((struct bpf_testmod_ops *)kdata)->data = ((struct bpf_testmod_ops *)udata)->data;
 		return 1;
 	}
+
+	if (member->offset == offsetof(struct bpf_testmod_ops, test_trampoline) * 8)
+		st_ops_trampoline = (struct bpf_testmod_ops *)kdata;
+
 	return 0;
 }
 
@@ -1694,6 +1704,13 @@ bpf_testmod_ops__test_return_ref_kptr(int dummy, struct task_struct *task__ref,
 	return NULL;
 }
 
+static int bpf_testmod_ops__test_trampoline(int arg1, int arg2, int arg3,
+					    int arg4, int arg5, int arg6,
+					    int arg7, int arg8, int arg9)
+{
+	return arg9;
+}
+
 static struct bpf_testmod_ops __bpf_testmod_ops = {
 	.test_1 = bpf_testmod_test_1,
 	.test_2 = bpf_testmod_test_2,
@@ -1701,6 +1718,7 @@ static struct bpf_testmod_ops __bpf_testmod_ops = {
 	.test_refcounted = bpf_testmod_ops__test_refcounted,
 	.test_refcounted_multi = bpf_testmod_ops__test_refcounted_multi,
 	.test_return_ref_kptr = bpf_testmod_ops__test_return_ref_kptr,
+	.test_trampoline = bpf_testmod_ops__test_trampoline,
 };
 
 struct bpf_struct_ops bpf_bpf_testmod_ops = {
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
index 210b919290cc..a5349d09ce55 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
@@ -46,6 +46,11 @@ struct bpf_testmod_ops {
 	struct task_struct *(*test_return_ref_kptr)(int dummy, struct task_struct *task,
 						    struct cgroup *cgrp);
 
+	/* Used to test indirect struct_ops trampolines stack-passed arguments (>8 args). */
+	int (*test_trampoline)(int arg1, int arg2, int arg3,
+			       int arg4, int arg5, int arg6,
+			       int arg7, int arg8, int arg9);
+
 	/* The following fields are used to test shadow copies. */
 	char onebyte;
 	struct {
-- 
2.42.0

Re: [PATCH bpf-next v1] selftests/bpf: Add test for indirect struct_ops trampoline

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free and data races due to statically assigned and uncleared struct_ops pointer.
--

commit 23e6150eb62c7059e7721142219a9a87264e2e46
Author: Tiezhu Yang <yangtiezhu@loongson.cn>

selftests/bpf: Add test for indirect struct_ops trampoline

This commit adds a test case to verify that arguments passed on the stack
are correctly read by the indirect struct_ops trampoline. It ensures the
correctness of stack offsets on architectures like LoongArch and RISC-V.

> diff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c
> new file mode 100644
> index 0000000000000..5a21aedd02fc5
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c
> @@ -0,0 +1,41 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <test_progs.h>
> +#include "struct_ops_trampoline.skel.h"
> +
> +#if defined(__loongarch__) || defined(__riscv)
> +static void run_struct_ops_trampoline(void)
> +{
[ ... ]
> +	bpf_link__destroy(link);
> +cleanup:
> +	struct_ops_trampoline__destroy(skel);

[Severity: High]
Does this call to struct_ops_trampoline__destroy() free the map?

Later in this diff, we see that st_ops_trampoline in bpf_testmod.c is
assigned dynamically allocated memory from this map. When the map is freed
here, st_ops_trampoline appears to become a dangling pointer.

> +}
> +#endif

[ ... ]

> diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> index 850cf4f830c48..be96bbc1b7c04 100644
> --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
[ ... ]
> @@ -637,6 +640,9 @@ bpf_testmod_test_read(struct file *file, struct kobject *kobj,
>  
>  	bpf_testmod_test_struct_ops3();
>  
> +	if (st_ops_trampoline && st_ops_trampoline->test_trampoline)
> +		st_ops_trampoline->test_trampoline(1, 2, 3, 4, 5, 6, 7, 8, 9999);

[Severity: High]
Since st_ops_trampoline is never cleared after the map is freed, could this
result in a use-after-free?

Any subsequent or parallel test in the suite that triggers
trigger_module_test_read() will invoke bpf_testmod_test_read(), incorrectly
evaluate st_ops_trampoline as valid, and dereference the freed memory.

> +
>  	struct_arg3 = kmalloc((sizeof(struct bpf_testmod_struct_arg_3) +
>  				sizeof(int)), GFP_KERNEL);
[ ... ]
> @@ -1619,6 +1625,10 @@ static int bpf_testmod_ops_init_member(const struct btf_type *t,
>  		((struct bpf_testmod_ops *)kdata)->data = ((struct bpf_testmod_ops *)udata)->data;
>  		return 1;
>  	}
> +
> +	if (member->offset == offsetof(struct bpf_testmod_ops, test_trampoline) * 8)
> +		st_ops_trampoline = (struct bpf_testmod_ops *)kdata;

[Severity: High]
Is it safe to unconditionally assign this global pointer to the map's
dynamically allocated memory during initialization without setting up a
cleanup mechanism?

Additionally, this assignment appears to occur without locking at map creation
time, meaning parallel test runs could race to overwrite this pointer.

> +
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260828042715.16546-1-yangtiezhu@loongson.cn?part=1

Re: [PATCH bpf-next v1] selftests/bpf: Add test for indirect struct_ops trampoline

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 3214 bytes --]

> diff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c
> new file mode 100644
> index 0000000000000..5a21aedd02fc5
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c
> @@ -0,0 +1,41 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <test_progs.h>
> +#include "struct_ops_trampoline.skel.h"

A subsystem pattern flags this as potentially concerning: the new
standalone prog_tests file plus a new progs file are added to cover a
9-argument struct_ops callback whose last argument is stack-passed.

tools/testing/selftests/bpf/progs/struct_ops_arena.c already exercises
this shape via bpf_testmod_ops3.test_arena_stack, whose declaration in
bpf_testmod.h carries the comment "enough leading args to force @ptr onto
the stack on x86 and arm64", and test_arena_stack_cb() already pins the
slot layout with argument checks before using ctx[8]. That test is driven
from prog_tests/test_struct_ops_arena.c in the same directory.

The plausible reason for a separate file is that the arena test is gated
to __x86_64__ || __aarch64__ and needs arena support, which LoongArch and
RISC-V lack.

Could a plain (non-arena) >8-argument member on bpf_testmod_ops3 plus a
new case in test_struct_ops_arena.c or test_struct_ops_multi_args.c have
avoided a new test binary?

[ ... ]

> diff --git a/tools/testing/selftests/bpf/progs/struct_ops_trampoline.c b/tools/testing/selftests/bpf/progs/struct_ops_trampoline.c
> new file mode 100644
> index 0000000000000..b0fc19a2a0c53
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/struct_ops_trampoline.c
> @@ -0,0 +1,24 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <vmlinux.h>
> +#include <bpf/bpf_tracing.h>
> +#include "../test_kmods/bpf_testmod.h"
> +#include "bpf_misc.h"

This isn't a bug, but could the bpf_misc.h include be dropped? The
program has no __failure/__success/__msg/__retval/__sink/__arch_*
annotation, unlike progs/struct_ops_multi_args.c which includes the same
header and does use __failure __msg(...).

[ ... ]

> diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> index 850cf4f830c48..be96bbc1b7c04 100644
> --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> @@ -589,6 +589,9 @@ noinline int bpf_testmod_trampoline_count_test(void)
>  	return 0;
>  }
>
> +struct bpf_testmod_ops;
> +static struct bpf_testmod_ops *st_ops_trampoline;

This isn't a bug, but does the struct bpf_testmod_ops forward declaration
add anything here? bpf_testmod.c already includes "bpf_testmod.h" at the
top, which defines the struct completely, and the dereference below at
st_ops_trampoline->test_trampoline requires the complete type. The
neighbouring static struct bpf_testmod_ops3 *st_ops3 carries no such
forward declaration.

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33142391368

Re: [PATCH bpf-next v1] selftests/bpf: Add test for indirect struct_ops trampoline

[Tiezhu Yang]

On 2026/8/28 下午12:36, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Use-After-Free and data races due to statically assigned and uncleared struct_ops pointer.
> --
> 
> commit 23e6150eb62c7059e7721142219a9a87264e2e46
> Author: Tiezhu Yang <yangtiezhu@loongson.cn>
> 
> selftests/bpf: Add test for indirect struct_ops trampoline
> 
> This commit adds a test case to verify that arguments passed on the stack
> are correctly read by the indirect struct_ops trampoline. It ensures the
> correctness of stack offsets on architectures like LoongArch and RISC-V.
> 
>> diff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c
>> new file mode 100644
>> index 0000000000000..5a21aedd02fc5
>> --- /dev/null
>> +++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_trampoline.c
>> @@ -0,0 +1,41 @@
>> +// SPDX-License-Identifier: GPL-2.0
>> +#include <test_progs.h>
>> +#include "struct_ops_trampoline.skel.h"
>> +
>> +#if defined(__loongarch__) || defined(__riscv)
>> +static void run_struct_ops_trampoline(void)
>> +{
> [ ... ]
>> +	bpf_link__destroy(link);
>> +cleanup:
>> +	struct_ops_trampoline__destroy(skel);
> 
> [Severity: High]
> Does this call to struct_ops_trampoline__destroy() free the map?
> 
> Later in this diff, we see that st_ops_trampoline in bpf_testmod.c is
> assigned dynamically allocated memory from this map. When the map is freed
> here, st_ops_trampoline appears to become a dangling pointer.
> 
>> +}
>> +#endif
> 
> [ ... ]
> 
>> diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
>> index 850cf4f830c48..be96bbc1b7c04 100644
>> --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
>> +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> [ ... ]
>> @@ -637,6 +640,9 @@ bpf_testmod_test_read(struct file *file, struct kobject *kobj,
>>   
>>   	bpf_testmod_test_struct_ops3();
>>   
>> +	if (st_ops_trampoline && st_ops_trampoline->test_trampoline)
>> +		st_ops_trampoline->test_trampoline(1, 2, 3, 4, 5, 6, 7, 8, 9999);
> 
> [Severity: High]
> Since st_ops_trampoline is never cleared after the map is freed, could this
> result in a use-after-free?
> 
> Any subsequent or parallel test in the suite that triggers
> trigger_module_test_read() will invoke bpf_testmod_test_read(), incorrectly
> evaluate st_ops_trampoline as valid, and dereference the freed memory.
> 
>> +
>>   	struct_arg3 = kmalloc((sizeof(struct bpf_testmod_struct_arg_3) +
>>   				sizeof(int)), GFP_KERNEL);
> [ ... ]
>> @@ -1619,6 +1625,10 @@ static int bpf_testmod_ops_init_member(const struct btf_type *t,
>>   		((struct bpf_testmod_ops *)kdata)->data = ((struct bpf_testmod_ops *)udata)->data;
>>   		return 1;
>>   	}
>> +
>> +	if (member->offset == offsetof(struct bpf_testmod_ops, test_trampoline) * 8)
>> +		st_ops_trampoline = (struct bpf_testmod_ops *)kdata;
> 
> [Severity: High]
> Is it safe to unconditionally assign this global pointer to the map's
> dynamically allocated memory during initialization without setting up a
> cleanup mechanism?
> 
> Additionally, this assignment appears to occur without locking at map creation
> time, meaning parallel test runs could race to overwrite this pointer.

You are right. I will fix the use-after-free and race conditions.

Here is the incremental diff based on this v1 patch:

diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c 
b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
index be96bbc1b7c0..471e4ed4192e 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
@@ -589,7 +589,7 @@ noinline int bpf_testmod_trampoline_count_test(void)
         return 0;
  }

-struct bpf_testmod_ops;
+static DEFINE_MUTEX(st_ops_trampoline_mutex);
  static struct bpf_testmod_ops *st_ops_trampoline;

  noinline ssize_t
@@ -640,8 +640,10 @@ bpf_testmod_test_read(struct file *file, struct 
kobject *kobj,

         bpf_testmod_test_struct_ops3();

+       mutex_lock(&st_ops_trampoline_mutex);
         if (st_ops_trampoline && st_ops_trampoline->test_trampoline)
                 st_ops_trampoline->test_trampoline(1, 2, 3, 4, 5, 6, 7, 
8, 9999);
+       mutex_unlock(&st_ops_trampoline_mutex);

         struct_arg3 = kmalloc((sizeof(struct bpf_testmod_struct_arg_3) +
                                 sizeof(int)), GFP_KERNEL);
@@ -1626,8 +1628,16 @@ static int bpf_testmod_ops_init_member(const 
struct btf_type *t,
                 return 1;
         }

-       if (member->offset == offsetof(struct bpf_testmod_ops, 
test_trampoline) * 8)
+       if (member->offset == offsetof(struct bpf_testmod_ops, 
test_trampoline) * 8) {
+               mutex_lock(&st_ops_trampoline_mutex);
+               if (st_ops_trampoline) {
+                       pr_err("st_ops_trampoline has already been 
registered\n");
+                       mutex_unlock(&st_ops_trampoline_mutex);
+                       return -EEXIST;
+               }
                 st_ops_trampoline = (struct bpf_testmod_ops *)kdata;
+               mutex_unlock(&st_ops_trampoline_mutex);
+       }

         return 0;
  }
@@ -1663,6 +1673,10 @@ static int bpf_dummy_reg(void *kdata, struct 
bpf_link *link)

  static void bpf_dummy_unreg(void *kdata, struct bpf_link *link)
  {
+       mutex_lock(&st_ops_trampoline_mutex);
+       if (st_ops_trampoline == (struct bpf_testmod_ops *)kdata)
+               st_ops_trampoline = NULL;
+       mutex_unlock(&st_ops_trampoline_mutex);
  }

  static int bpf_testmod_test_1(void)

Thanks,
Tiezhu