From: sashiko-bot@kernel.org
To: "Yun Lu" <luyun_611@163.com>
Cc: bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next v2 6/8] selftests/bpf: Check bpf_wq value membership
Date: Fri, 06 Nov 2026 11:26:17 +0000 [thread overview]
Message-ID: <sashiko-outbox-201311@kernel.org> (raw)
In-Reply-To: <20261106095747.471718-7-luyun_611@163.com>
Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [Low] selftests/bpf: multi-line comment style violation in
bpf_wq_membership.c
- [Low] selftests/bpf: single-use macros DEFINE_WQ_MAP and
WQ_DELETE_INIT
--
commit 67a78af8389db430f474e1214b9e087d1c068104
Author: Yun Lu <luyun@kylinos.cn>
selftests/bpf: Check bpf_wq value membership
This commit adds BPF selftests covering bpf_wq initialization on deleted or
replaced map values as well as live HASH and ARRAY map callbacks.
> diff --git a/tools/testing/selftests/bpf/progs/bpf_wq_membership.c b/tools/testing/selftests/bpf/progs/bpf_wq_membership.c
> new file mode 100644
> index 0000000000000..b78b4f1422b3d
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/bpf_wq_membership.c
[ ... ]
> +/* Delete and initialize through the retained pointer in one RCU section.
> + * Never configure or start work through that pointer, even if init succeeds.
> + */
[Severity: Low]
This isn't a bug, but BPF coding style places the opening /* of a
multi-line comment on its own line.
> +#define WQ_DELETE_INIT(map_sym, v) \
> + ({ \
> + long __e; \
> + bpf_rcu_read_lock(); \
> + res_delete_err = bpf_map_delete_elem(&map_sym, &key); \
> + __e = res_delete_err; \
> + if (!__e) \
> + res_init_err = bpf_wq_init(&(v)->wq, &map_sym, 0); \
> + bpf_rcu_read_unlock(); \
> + __e; \
> + })
> +
> +#define DEFINE_WQ_MAP(map_sym, value_type) \
> +static int map_sym##_cb(void *map, int *key, void *value) \
> +{ \
> + value_type *v = value; \
> + \
> + __sync_fetch_and_add(&cb_count[v->cookie & (CB_SLOTS - 1)], 1); \
> + return 0; \
> +} \
> + \
> +SEC("syscall") \
> +int map_sym##_run(void *ctx) \
> +{ \
[ ... ]
> +DEFINE_WQ_MAP(values, struct wq_value)
[Severity: Low]
This isn't a bug, but DEFINE_WQ_MAP() and WQ_DELETE_INIT() are only
expanded once, and WQ_DELETE_INIT() implicitly captures the caller's local
key variable while returning an unused value. Could values_cb() and
values_run() be written directly as plain functions with WQ_DELETE_INIT()
inlined, and could these subtests be added to
tools/testing/selftests/bpf/prog_tests/wq.c instead of a separate test
file?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261106095747.471718-1-luyun_611@163.com?part=6
next prev parent reply other threads:[~2026-11-06 11:26 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-06 9:57 [PATCH bpf-next v2 0/8] bpf: Fix async callback use-after-free on map deletion Yun Lu
2026-11-06 9:57 ` [PATCH bpf-next v2 1/8] bpf: Mark task work FREED before detaching it Yun Lu
2026-11-06 9:57 ` [PATCH bpf-next v2 2/8] bpf: Check task work value membership before scheduling Yun Lu
2026-11-06 9:57 ` [PATCH bpf-next v2 3/8] selftests/bpf: Check task work value membership Yun Lu
2026-11-06 10:31 ` bot+bpf-ci
2026-11-06 10:56 ` sashiko-bot
2026-11-06 9:57 ` [PATCH bpf-next v2 4/8] bpf: Order async callback admission and cancellation Yun Lu
2026-11-06 9:57 ` [PATCH bpf-next v2 5/8] bpf: Check bpf_wq value membership before use Yun Lu
2026-11-06 9:57 ` [PATCH bpf-next v2 6/8] selftests/bpf: Check bpf_wq value membership Yun Lu
2026-11-06 10:31 ` bot+bpf-ci
2026-11-06 11:26 ` sashiko-bot [this message]
2026-11-06 9:57 ` [PATCH bpf-next v2 7/8] bpf: Check bpf_timer value membership before use Yun Lu
2026-11-06 10:31 ` bot+bpf-ci
2026-11-06 9:57 ` [PATCH bpf-next v2 8/8] selftests/bpf: Check bpf_timer value membership Yun Lu
2026-11-06 10:31 ` bot+bpf-ci
2026-11-06 11:51 ` sashiko-bot
2026-11-06 17:16 ` [PATCH bpf-next v2 0/8] bpf: Fix async callback use-after-free on map deletion Alexei Starovoitov
2026-11-09 9:50 ` luyun
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-201311@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=luyun_611@163.com \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.