From: Sasha Levin <sashal@kernel.org>
To: patches@lists.linux.dev, stable@vger.kernel.org
Cc: Jiayuan Chen <jiayuan.chen@linux.dev>,
Dan Carpenter <dan.carpenter@linaro.org>,
Andrii Nakryiko <andrii@kernel.org>,
Sasha Levin <sashal@kernel.org>,
martin.lau@kernel.org, jiapeng.chong@linux.alibaba.com,
ast@kernel.org, bpf@vger.kernel.org
Subject: [PATCH AUTOSEL 6.17-6.16] selftests/bpf: Fix incorrect array size calculation
Date: Thu, 9 Oct 2025 11:54:48 -0400 [thread overview]
Message-ID: <20251009155752.773732-22-sashal@kernel.org> (raw)
In-Reply-To: <20251009155752.773732-1-sashal@kernel.org>
From: Jiayuan Chen <jiayuan.chen@linux.dev>
[ Upstream commit f85981327a90c51e76f60e073cb6648b2f167226 ]
The loop in bench_sockmap_prog_destroy() has two issues:
1. Using 'sizeof(ctx.fds)' as the loop bound results in the number of
bytes, not the number of file descriptors, causing the loop to iterate
far more times than intended.
2. The condition 'ctx.fds[0] > 0' incorrectly checks only the first fd for
all iterations, potentially leaving file descriptors unclosed. Change
it to 'ctx.fds[i] > 0' to check each fd properly.
These fixes ensure correct cleanup of all file descriptors when the
benchmark exits.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250909124721.191555-1-jiayuan.chen@linux.dev
Closes: https://lore.kernel.org/bpf/aLqfWuRR9R_KTe5e@stanley.mountain/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
LLM Generated explanations, may be completely bogus:
YES
- `tools/testing/selftests/bpf/benchs/bench_sockmap.c:13` now pulls in
`bpf_util.h`, matching the pattern already used by other BPF bench
tests so the new `ARRAY_SIZE()` usage compiles on every branch that
carries this benchmark (introduced in `7b2fa44de5e71`, tagged around
v6.16-rc1).
- `tools/testing/selftests/bpf/benchs/bench_sockmap.c:129` replaces the
byte-counted `sizeof(ctx.fds)` loop bound with `ARRAY_SIZE(ctx.fds)`,
stopping the loop after the five real descriptors instead of wandering
into the struct’s counters and repeatedly closing fd 0 or large
garbage values. That out-of-bounds iteration currently kills the
test’s own stdin and can hand later socket allocations fd 0, so the
cleanup path leaks every other socket.
- `tools/testing/selftests/bpf/benchs/bench_sockmap.c:130` now checks
`ctx.fds[i] > 0` per element instead of reusing `ctx.fds[0]`, which
fixes real leak scenarios when the first slot is zero (either after
the stray `close(0)` above or when `create_pair()` fails before
assigning `c1` but other sockets were opened).
- Fix stays confined to the selftest helper and mirrors existing bench
code practices, so regression risk is negligible while restoring
reliable cleanup for the new sockmap benchmark—exactly the sort of
correctness fix stable trees keep so their shipped selftests actually
work.
Natural next step: queue this for the stable branches that already
picked up `bench_sockmap.c` (v6.16+).
tools/testing/selftests/bpf/benchs/bench_sockmap.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/benchs/bench_sockmap.c b/tools/testing/selftests/bpf/benchs/bench_sockmap.c
index 8ebf563a67a2b..cfc072aa7fff7 100644
--- a/tools/testing/selftests/bpf/benchs/bench_sockmap.c
+++ b/tools/testing/selftests/bpf/benchs/bench_sockmap.c
@@ -10,6 +10,7 @@
#include <argp.h>
#include "bench.h"
#include "bench_sockmap_prog.skel.h"
+#include "bpf_util.h"
#define FILE_SIZE (128 * 1024)
#define DATA_REPEAT_SIZE 10
@@ -124,8 +125,8 @@ static void bench_sockmap_prog_destroy(void)
{
int i;
- for (i = 0; i < sizeof(ctx.fds); i++) {
- if (ctx.fds[0] > 0)
+ for (i = 0; i < ARRAY_SIZE(ctx.fds); i++) {
+ if (ctx.fds[i] > 0)
close(ctx.fds[i]);
}
--
2.51.0
next prev parent reply other threads:[~2025-10-09 15:58 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20251009155752.773732-1-sashal@kernel.org>
2025-10-09 15:54 ` [PATCH AUTOSEL 6.17-5.4] bpf: Don't use %pK through printk Sasha Levin
2025-10-09 15:54 ` [PATCH AUTOSEL 6.17-6.1] bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 Sasha Levin
2025-10-09 15:54 ` [PATCH AUTOSEL 6.17-6.12] bpf: Use tnums for JEQ/JNE is_branch_taken logic Sasha Levin
2025-10-09 15:54 ` Sasha Levin [this message]
2025-10-09 15:54 ` [PATCH AUTOSEL 6.17-6.12] selftests/bpf: Fix selftest verifier_arena_large failure Sasha Levin
2025-10-09 15:55 ` [PATCH AUTOSEL 6.17-6.1] bpf: Clear pfmemalloc flag when freeing all fragments Sasha Levin
2025-10-09 15:55 ` [PATCH AUTOSEL 6.17-5.4] selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 Sasha Levin
2025-10-09 15:55 ` [PATCH AUTOSEL 6.17-6.12] selftests/bpf: Fix flaky bpf_cookie selftest Sasha Levin
2025-10-09 15:55 ` [PATCH AUTOSEL 6.17] selftests: drv-net: Pull data before parsing headers Sasha Levin
2025-10-09 15:55 ` [PATCH AUTOSEL 6.17-6.12] libbpf: Fix USDT SIB argument handling causing unrecognized register error Sasha Levin
2025-10-09 15:55 ` [PATCH AUTOSEL 6.17-6.12] bpftool: Add CET-aware symbol matching for x86_64 architectures Sasha Levin
2025-10-09 15:55 ` [PATCH AUTOSEL 6.17-6.6] bpf: Do not limit bpf_cgroup_from_id to current's namespace Sasha Levin
2025-10-09 15:55 ` [PATCH AUTOSEL 6.17-6.1] selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh Sasha Levin
2025-10-09 15:55 ` [PATCH AUTOSEL 6.17-6.16] selftests/bpf: Fix arena_spin_lock selftest failure Sasha Levin
2025-10-09 15:56 ` [PATCH AUTOSEL 6.17-6.6] riscv: bpf: Fix uninitialized symbol 'retval_off' Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251009155752.773732-22-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=dan.carpenter@linaro.org \
--cc=jiapeng.chong@linux.alibaba.com \
--cc=jiayuan.chen@linux.dev \
--cc=martin.lau@kernel.org \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox