Re: [PATCH bpf-next 3/3] selftests/bpf: Add a test for arena fault-in under memory.max

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 7/28/26 8:54 AM, Emil Tsalapatis wrote:
> On Mon Jul 27, 2026 at 2:24 AM EDT, Jiayuan Chen wrote:
>> A child joins a memcg capped at 64M and faults an arena in until it runs
>> out of the budget. Without the kernel fix the child dies with SIGSEGV on
>> a valid arena address; with it, the child is killed by the memcg OOM
>> killer.
>>
>> With the fix:
>>
>>    serial_test_arena_memcg:PASS:child killed by signal
>>    serial_test_arena_memcg:PASS:not killed by SIGSEGV
>>    #5       arena_memcg:OK
>>
>>    # dmesg
>>     arena_vm_fault+0x655/0xa90
>>    Memory cgroup out of memory: Killed process 512, file-rss:67920kB
>>
>> Without the fix:
>>
>>    serial_test_arena_memcg:PASS:child killed by signal
>>    serial_test_arena_memcg:FAIL:not killed by SIGSEGV: actual 11
>>    #5       arena_memcg:FAIL
>>
>>    # dmesg
>>    test_progs[508]: segfault at 100004025000 ...
>>
>> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
>> ---
>>   .../selftests/bpf/prog_tests/arena_memcg.c    | 158 ++++++++++++++++++
>>   .../testing/selftests/bpf/progs/arena_memcg.c |  24 +++
>>   2 files changed, 182 insertions(+)
>>   create mode 100644 tools/testing/selftests/bpf/prog_tests/arena_memcg.c
>>   create mode 100644 tools/testing/selftests/bpf/progs/arena_memcg.c
>>
>> diff --git a/tools/testing/selftests/bpf/prog_tests/arena_memcg.c b/tools/testing/selftests/bpf/prog_tests/arena_memcg.c
>> new file mode 100644
>> index 000000000000..9665946fa29e
>> --- /dev/null
>> +++ b/tools/testing/selftests/bpf/prog_tests/arena_memcg.c
>> @@ -0,0 +1,158 @@
>> +// SPDX-License-Identifier: GPL-2.0
>> +
>> +#include <test_progs.h>
>> +#include <fcntl.h>
>> +#include <signal.h>
>> +#include <sys/mman.h>
>> +#include <sys/wait.h>
>> +#include <unistd.h>
>> +#include <sys/user.h>
>> +#ifndef PAGE_SIZE /* on some archs it comes in sys/user.h */
>> +#include <unistd.h>
>> +#define PAGE_SIZE getpagesize()
>> +#endif
>> +
>> +#include "cgroup_helpers.h"
>> +#include "arena_memcg.skel.h"
>> +
>> +#define CG_PATH		"/arena_memcg"
>> +
>> +/* Budget the arena gets on top of whatever is already charged after load. */
>> +#define ARENA_BUDGET	(64 * 1024 * 1024)
>> +
>> +/*
>> + * cgroup_helpers builds paths from getpid(), but the work dir belongs to the
>> + * process that set the environment up. The child references it through that
>> + * pid, so build the path explicitly.
>> + */
>> +static void cg_file_path(char *buf, size_t sz, pid_t owner, const char *file)
>> +{
>> +	snprintf(buf, sz, "/mnt/cgroup-test-work-dir%d%s/%s", owner, CG_PATH, file);
> These are copied over from cgroup_helpers.c, but it's not obvious they
> originate from there. Maybe let's move them to cgroup_helpers.h where we
> can use them everywhere for consistency.

Agreed.


>
> The main issue I see is that this only triggers consistently with PREEMPT_RT, correct?


It's not RT specified issue.


> I tried with the default vmtest config we have but it does not trigger
> at all. More importantly, it doesn't trigger reliably with PREEMPT_RT,
> either. Does it for you? Can we cycle forks/frees multiple times to try
> and trigger this more reliably?



I stated vm(RT and non-RT) locally and ran test_progs 100 times and all 
tests passed.

I also used official bpf CI(non-RT) to run selftest, but still all tests 
passed...

So I'm not clear which config is associated with...
https://github.com/kernel-patches/bpf/actions/runs/30795982316
https://github.com/kernel-patches/bpf/actions/runs/30798024430
https://github.com/kernel-patches/bpf/actions/runs/30801539977
https://github.com/kernel-patches/bpf/actions/runs/30808717560