[PATCH bpf-next v2] selftests/bpf: Add test for indirect struct_ops trampoline

[PATCH bpf-next v2] selftests/bpf: Add test for indirect struct_ops trampoline

[Tiezhu Yang]

Add a test case to verify that arguments passed on the stack are correctly
read by an indirect struct_ops trampoline.

This test ensures the correctness of stack offsets on architectures like
LoongArch and RISC-V where arguments beyond the first 8 slots are passed
via the stack.

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
---
This is to test the following two patches:

bpf, riscv: Fix stack-passed arguments for indirect trampolines
https://lore.kernel.org/bpf/20260821233516.3426127-3-memxor@gmail.com/

bpf, loongarch: Fix stack arguments for indirect trampolines
https://lore.kernel.org/bpf/20260821233516.3426127-8-memxor@gmail.com/

v2:
  -- Fix use-after-free and race conditions
  -- Modify current files to avoid new binary

 .../prog_tests/test_struct_ops_multi_args.c   | 49 ++++++++++++++++++-
 .../bpf/progs/struct_ops_multi_args.c         | 13 +++++
 .../selftests/bpf/test_kmods/bpf_testmod.c    | 32 ++++++++++++
 .../selftests/bpf/test_kmods/bpf_testmod.h    |  5 ++
 4 files changed, 98 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
index 0f321e889862..7f6f9d61c9e0 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
@@ -3,7 +3,54 @@
 #include <test_progs.h>
 #include "struct_ops_multi_args.skel.h"
 
+static void test_refcounted_multi(void)
+{
+	struct struct_ops_multi_args *skel;
+	int err;
+
+	skel = struct_ops_multi_args__open();
+	if (!ASSERT_OK_PTR(skel, "struct_ops_multi_args__open"))
+		return;
+
+	err = struct_ops_multi_args__load(skel);
+	ASSERT_EQ(err, -EINVAL, "struct_ops_multi_args__load");
+
+	struct_ops_multi_args__destroy(skel);
+}
+
+static void test_trampoline_stack_args(void)
+{
+	struct struct_ops_multi_args *skel;
+	struct bpf_link *link = NULL;
+	int err;
+
+	skel = struct_ops_multi_args__open();
+	if (!ASSERT_OK_PTR(skel, "struct_ops_multi_args__open"))
+		return;
+
+	bpf_program__set_autoload(skel->progs.test_refcounted_multi, false);
+	skel->struct_ops.testmod_ref_acquire->test_refcounted_multi = NULL;
+
+	err = struct_ops_multi_args__load(skel);
+	if (!ASSERT_OK(err, "struct_ops_multi_args__load"))
+		goto out;
+
+	link = bpf_map__attach_struct_ops(skel->maps.testmod_ref_acquire);
+	if (!ASSERT_OK_PTR(link, "bpf_map__attach_struct_ops"))
+		goto out;
+
+	ASSERT_EQ(skel->bss->got_arg9, 9999, "check_stack_passed_arg9");
+
+out:
+	bpf_link__destroy(link);
+	struct_ops_multi_args__destroy(skel);
+}
+
 void test_struct_ops_multi_args(void)
 {
-	RUN_TESTS(struct_ops_multi_args);
+	if (test__start_subtest("test_refcounted_multi"))
+		test_refcounted_multi();
+
+	if (test__start_subtest("test_trampoline_stack_args"))
+		test_trampoline_stack_args();
 }
diff --git a/tools/testing/selftests/bpf/progs/struct_ops_multi_args.c b/tools/testing/selftests/bpf/progs/struct_ops_multi_args.c
index c62be15757f0..f0f47676b099 100644
--- a/tools/testing/selftests/bpf/progs/struct_ops_multi_args.c
+++ b/tools/testing/selftests/bpf/progs/struct_ops_multi_args.c
@@ -29,7 +29,20 @@ int test_refcounted_multi(unsigned long long *ctx)
 	return 0;
 }
 
+__u64 got_arg9 = 0;
+
+SEC("struct_ops/test_trampoline_stack_args")
+int BPF_PROG(test_trampoline_stack_args, int arg1, int arg2, int arg3,
+					 int arg4, int arg5, int arg6,
+					 int arg7, int arg8, int arg9)
+{
+	got_arg9 = arg9;
+
+	return 0;
+}
+
 SEC(".struct_ops.link")
 struct bpf_testmod_ops testmod_ref_acquire = {
 	.test_refcounted_multi = (void *)test_refcounted_multi,
+	.test_trampoline_stack_args = (void *)test_trampoline_stack_args,
 };
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
index 2380b6cbdead..8f0744e6075b 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
@@ -1678,6 +1678,9 @@ static bool bpf_testmod_ops_is_valid_access(int off, int size,
 	return bpf_tracing_btf_ctx_access(off, size, type, prog, info);
 }
 
+static DEFINE_MUTEX(st_ops_trampoline_mutex);
+static struct bpf_testmod_ops *st_ops_trampoline;
+
 static int bpf_testmod_ops_init_member(const struct btf_type *t,
 				       const struct btf_member *member,
 				       void *kdata, const void *udata)
@@ -1691,6 +1694,18 @@ static int bpf_testmod_ops_init_member(const struct btf_type *t,
 		((struct bpf_testmod_ops *)kdata)->data = ((struct bpf_testmod_ops *)udata)->data;
 		return 1;
 	}
+
+	if (member->offset == offsetof(struct bpf_testmod_ops, test_trampoline_stack_args) * 8) {
+		mutex_lock(&st_ops_trampoline_mutex);
+		if (st_ops_trampoline) {
+			pr_err("st_ops_trampoline has already been registered\n");
+			mutex_unlock(&st_ops_trampoline_mutex);
+			return -EEXIST;
+		}
+		st_ops_trampoline = (struct bpf_testmod_ops *)kdata;
+		mutex_unlock(&st_ops_trampoline_mutex);
+	}
+
 	return 0;
 }
 
@@ -1720,11 +1735,20 @@ static int bpf_dummy_reg(void *kdata, struct bpf_link *link)
 	if (ops->test_2)
 		ops->test_2(4, ops->data);
 
+	mutex_lock(&st_ops_trampoline_mutex);
+	if (st_ops_trampoline && st_ops_trampoline->test_trampoline_stack_args)
+		st_ops_trampoline->test_trampoline_stack_args(1, 2, 3, 4, 5, 6, 7, 8, 9999);
+	mutex_unlock(&st_ops_trampoline_mutex);
+
 	return 0;
 }
 
 static void bpf_dummy_unreg(void *kdata, struct bpf_link *link)
 {
+	mutex_lock(&st_ops_trampoline_mutex);
+	if (st_ops_trampoline == (struct bpf_testmod_ops *)kdata)
+		st_ops_trampoline = NULL;
+	mutex_unlock(&st_ops_trampoline_mutex);
 }
 
 static int bpf_testmod_test_1(void)
@@ -1766,6 +1790,13 @@ bpf_testmod_ops__test_return_ref_kptr(int dummy, struct task_struct *task__ref,
 	return NULL;
 }
 
+static int bpf_testmod_ops__test_trampoline_stack_args(int arg1, int arg2, int arg3,
+						       int arg4, int arg5, int arg6,
+						       int arg7, int arg8, int arg9)
+{
+	return arg9;
+}
+
 static struct bpf_testmod_ops __bpf_testmod_ops = {
 	.test_1 = bpf_testmod_test_1,
 	.test_2 = bpf_testmod_test_2,
@@ -1773,6 +1804,7 @@ static struct bpf_testmod_ops __bpf_testmod_ops = {
 	.test_refcounted = bpf_testmod_ops__test_refcounted,
 	.test_refcounted_multi = bpf_testmod_ops__test_refcounted_multi,
 	.test_return_ref_kptr = bpf_testmod_ops__test_return_ref_kptr,
+	.test_trampoline_stack_args = bpf_testmod_ops__test_trampoline_stack_args,
 };
 
 struct bpf_struct_ops bpf_bpf_testmod_ops = {
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
index 210b919290cc..42257ae89fd5 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.h
@@ -46,6 +46,11 @@ struct bpf_testmod_ops {
 	struct task_struct *(*test_return_ref_kptr)(int dummy, struct task_struct *task,
 						    struct cgroup *cgrp);
 
+	/* Used to test indirect struct_ops trampolines stack-passed arguments (>8 args). */
+	int (*test_trampoline_stack_args)(int arg1, int arg2, int arg3,
+					  int arg4, int arg5, int arg6,
+					  int arg7, int arg8, int arg9);
+
 	/* The following fields are used to test shadow copies. */
 	char onebyte;
 	struct {
-- 
2.42.0

Re: [PATCH bpf-next v2] selftests/bpf: Add test for indirect struct_ops trampoline

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] The introduction of global state (`st_ops_trampoline` and its mutex) in `bpf_testmod` causes parallel test breakages, permanent DoS, and Use-After-Free (UAF).
- [Medium] Removal of `RUN_TESTS` drops declarative verifier failure message matching, masking verifier bugs.
--

commit 932e6a2ea3847d584c9e377639c762f03a9fe713
Author: Tiezhu Yang <yangtiezhu@loongson.cn>

selftests/bpf: Add test for indirect struct_ops trampoline

Add a test case to verify that arguments passed on the stack are correctly
read by an indirect struct_ops trampoline.

> diff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
> index 0f321e8898620..7f6f9d61c9e07 100644
> --- a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
> +++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
> @@ -3,7 +3,54 @@
>  #include <test_progs.h>
>  #include "struct_ops_multi_args.skel.h"
>  
> +static void test_refcounted_multi(void)
> +{
> +	struct struct_ops_multi_args *skel;
> +	int err;
> +
> +	skel = struct_ops_multi_args__open();
> +	if (!ASSERT_OK_PTR(skel, "struct_ops_multi_args__open"))
> +		return;
> +
> +	err = struct_ops_multi_args__load(skel);
> +	ASSERT_EQ(err, -EINVAL, "struct_ops_multi_args__load");

[Severity: Medium]
Does this replace the test_loader's verifier log parsing with a manual
assertion?

By dropping RUN_TESTS in test_struct_ops_multi_args(), the test now silently
passes on any verifier error (such as invalid BTF or a missing map) returning
-EINVAL rather than validating the exact failure condition. This masks
potential verifier bugs.

[ ... ]

> diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> index 2380b6cbdeadc..8f0744e6075b3 100644
> --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
[ ... ]
> @@ -1691,6 +1694,18 @@ static int bpf_testmod_ops_init_member(const struct btf_type *t,
>  		((struct bpf_testmod_ops *)kdata)->data = ((struct bpf_testmod_ops *)udata)->data;
>  		return 1;
>  	}
> +
> +	if (member->offset == offsetof(struct bpf_testmod_ops, test_trampoline_stack_args) * 8) {
> +		mutex_lock(&st_ops_trampoline_mutex);
> +		if (st_ops_trampoline) {
> +			pr_err("st_ops_trampoline has already been registered\n");
> +			mutex_unlock(&st_ops_trampoline_mutex);
> +			return -EEXIST;
> +		}
> +		st_ops_trampoline = (struct bpf_testmod_ops *)kdata;

[Severity: High]
Can this cause a permanent denial of service in the test module?

This assigns the global pointer st_ops_trampoline to map-owned memory (kdata)
in bpf_testmod_ops_init_member() without establishing a teardown hook to clear
it if map registration fails after this point. If a failure occurs, the
pointer remains dangling, causing permanent -EEXIST failures for all
subsequent tests.

Additionally, this logic actively rejects concurrent map updates across all
parallel test executions.

> +		mutex_unlock(&st_ops_trampoline_mutex);
> +	}
> +
>  	return 0;
>  }
>  
> @@ -1720,11 +1735,20 @@ static int bpf_dummy_reg(void *kdata, struct bpf_link *link)
>  	if (ops->test_2)
>  		ops->test_2(4, ops->data);
>  
> +	mutex_lock(&st_ops_trampoline_mutex);
> +	if (st_ops_trampoline && st_ops_trampoline->test_trampoline_stack_args)
> +		st_ops_trampoline->test_trampoline_stack_args(1, 2, 3, 4, 5, 6, 7, 8, 9999);

[Severity: High]
Could this lead to a use-after-free?

This dereferences the global st_ops_trampoline which may point to freed memory
if a previous map update failed or if a map was concurrently detached. Since
the local ops pointer (kdata) is already passed directly to bpf_dummy_reg(),
is there any reason not to use ops directly here instead of relying on the
global state?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831085705.13747-1-yangtiezhu@loongson.cn?part=1

Re: [PATCH bpf-next v2] selftests/bpf: Add test for indirect struct_ops trampoline

[Tiezhu Yang]

On 2026/8/31 下午5:08, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
> - [High] The introduction of global state (`st_ops_trampoline` and its mutex) in `bpf_testmod` causes parallel test breakages, permanent DoS, and Use-After-Free (UAF).
> - [Medium] Removal of `RUN_TESTS` drops declarative verifier failure message matching, masking verifier bugs.
> --
> 
> commit 932e6a2ea3847d584c9e377639c762f03a9fe713
> Author: Tiezhu Yang <yangtiezhu@loongson.cn>
> 
> selftests/bpf: Add test for indirect struct_ops trampoline
> 
> Add a test case to verify that arguments passed on the stack are correctly
> read by an indirect struct_ops trampoline.
> 
>> diff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
>> index 0f321e8898620..7f6f9d61c9e07 100644
>> --- a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
>> +++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
>> @@ -3,7 +3,54 @@
>>   #include <test_progs.h>
>>   #include "struct_ops_multi_args.skel.h"
>>   
>> +static void test_refcounted_multi(void)
>> +{
>> +	struct struct_ops_multi_args *skel;
>> +	int err;
>> +
>> +	skel = struct_ops_multi_args__open();
>> +	if (!ASSERT_OK_PTR(skel, "struct_ops_multi_args__open"))
>> +		return;
>> +
>> +	err = struct_ops_multi_args__load(skel);
>> +	ASSERT_EQ(err, -EINVAL, "struct_ops_multi_args__load");
> 
> [Severity: Medium]
> Does this replace the test_loader's verifier log parsing with a manual
> assertion?
> 
> By dropping RUN_TESTS in test_struct_ops_multi_args(), the test now silently
> passes on any verifier error (such as invalid BTF or a missing map) returning
> -EINVAL rather than validating the exact failure condition. This masks
> potential verifier bugs.

I will manually use bpf_program__set_log_buf() to capture and verify
the log "program with __ref argument cannot tail call", like this:

```
diff --git 
a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c 
b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
index 7f6f9d61c9e0..c77601d4836c 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_args.c
@@ -6,15 +6,23 @@
  static void test_refcounted_multi(void)
  {
         struct struct_ops_multi_args *skel;
+       char log_buf[4096] = {};
         int err;

         skel = struct_ops_multi_args__open();
         if (!ASSERT_OK_PTR(skel, "struct_ops_multi_args__open"))
                 return;

+       bpf_program__set_log_buf(skel->progs.test_refcounted_multi, 
log_buf, sizeof(log_buf));
+
         err = struct_ops_multi_args__load(skel);
-       ASSERT_EQ(err, -EINVAL, "struct_ops_multi_args__load");
+       if (!ASSERT_EQ(err, -EINVAL, "struct_ops_multi_args__load"))
+               goto out;

+       ASSERT_OK_PTR(strstr(log_buf, "program with __ref argument 
cannot tail call"),
+                     "check_verifier_log_message");
+
+out:
         struct_ops_multi_args__destroy(skel);
  }

diff --git a/tools/testing/selftests/bpf/progs/struct_ops_multi_args.c 
b/tools/testing/selftests/bpf/progs/struct_ops_multi_args.c
index f0f47676b099..3176f5bd7798 100644
--- a/tools/testing/selftests/bpf/progs/struct_ops_multi_args.c
+++ b/tools/testing/selftests/bpf/progs/struct_ops_multi_args.c
@@ -17,7 +17,6 @@ struct {
  } prog_array SEC(".maps");

  SEC("struct_ops/test_refcounted_multi")
-__failure __msg("program with __ref argument cannot tail call")
  int test_refcounted_multi(unsigned long long *ctx)
  {
         /* ctx[2] is used because the refcounted variable is the third 
argument */
```

> [ ... ]
> 
>> diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
>> index 2380b6cbdeadc..8f0744e6075b3 100644
>> --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
>> +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> [ ... ]
>> @@ -1691,6 +1694,18 @@ static int bpf_testmod_ops_init_member(const struct btf_type *t,
>>   		((struct bpf_testmod_ops *)kdata)->data = ((struct bpf_testmod_ops *)udata)->data;
>>   		return 1;
>>   	}
>> +
>> +	if (member->offset == offsetof(struct bpf_testmod_ops, test_trampoline_stack_args) * 8) {
>> +		mutex_lock(&st_ops_trampoline_mutex);
>> +		if (st_ops_trampoline) {
>> +			pr_err("st_ops_trampoline has already been registered\n");
>> +			mutex_unlock(&st_ops_trampoline_mutex);
>> +			return -EEXIST;
>> +		}
>> +		st_ops_trampoline = (struct bpf_testmod_ops *)kdata;
> 
> [Severity: High]
> Can this cause a permanent denial of service in the test module?
> 
> This assigns the global pointer st_ops_trampoline to map-owned memory (kdata)
> in bpf_testmod_ops_init_member() without establishing a teardown hook to clear
> it if map registration fails after this point. If a failure occurs, the
> pointer remains dangling, causing permanent -EEXIST failures for all
> subsequent tests.
> 
> Additionally, this logic actively rejects concurrent map updates across all
> parallel test executions.
> 
>> +		mutex_unlock(&st_ops_trampoline_mutex);
>> +	}
>> +
>>   	return 0;
>>   }
>>   
>> @@ -1720,11 +1735,20 @@ static int bpf_dummy_reg(void *kdata, struct bpf_link *link)
>>   	if (ops->test_2)
>>   		ops->test_2(4, ops->data);
>>   
>> +	mutex_lock(&st_ops_trampoline_mutex);
>> +	if (st_ops_trampoline && st_ops_trampoline->test_trampoline_stack_args)
>> +		st_ops_trampoline->test_trampoline_stack_args(1, 2, 3, 4, 5, 6, 7, 8, 9999);
> 
> [Severity: High]
> Could this lead to a use-after-free?
> 
> This dereferences the global st_ops_trampoline which may point to freed memory
> if a previous map update failed or if a map was concurrently detached. Since
> the local ops pointer (kdata) is already passed directly to bpf_dummy_reg(),
> is there any reason not to use ops directly here instead of relying on the
> global state?

I will drop global state and mutex, just use the original kdata
in bpf_dummy_reg(), like this:

```
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c 
b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
index 8f0744e6075b..bb800bf2b0fd 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
@@ -1678,9 +1678,6 @@ static bool bpf_testmod_ops_is_valid_access(int 
off, int size,
         return bpf_tracing_btf_ctx_access(off, size, type, prog, info);
  }

-static DEFINE_MUTEX(st_ops_trampoline_mutex);
-static struct bpf_testmod_ops *st_ops_trampoline;
-
  static int bpf_testmod_ops_init_member(const struct btf_type *t,
                                        const struct btf_member *member,
                                        void *kdata, const void *udata)
@@ -1695,17 +1692,6 @@ static int bpf_testmod_ops_init_member(const 
struct btf_type *t,
                 return 1;
         }

-       if (member->offset == offsetof(struct bpf_testmod_ops, 
test_trampoline_stack_args) * 8) {
-               mutex_lock(&st_ops_trampoline_mutex);
-               if (st_ops_trampoline) {
-                       pr_err("st_ops_trampoline has already been 
registered\n");
-                       mutex_unlock(&st_ops_trampoline_mutex);
-                       return -EEXIST;
-               }
-               st_ops_trampoline = (struct bpf_testmod_ops *)kdata;
-               mutex_unlock(&st_ops_trampoline_mutex);
-       }
-
         return 0;
  }

@@ -1735,20 +1721,14 @@ static int bpf_dummy_reg(void *kdata, struct 
bpf_link *link)
         if (ops->test_2)
                 ops->test_2(4, ops->data);

-       mutex_lock(&st_ops_trampoline_mutex);
-       if (st_ops_trampoline && 
st_ops_trampoline->test_trampoline_stack_args)
-               st_ops_trampoline->test_trampoline_stack_args(1, 2, 3, 
4, 5, 6, 7, 8, 9999);
-       mutex_unlock(&st_ops_trampoline_mutex);
+       if (ops->test_trampoline_stack_args)
+               ops->test_trampoline_stack_args(1, 2, 3, 4, 5, 6, 7, 8, 
9999);

         return 0;
  }

  static void bpf_dummy_unreg(void *kdata, struct bpf_link *link)
  {
-       mutex_lock(&st_ops_trampoline_mutex);
-       if (st_ops_trampoline == (struct bpf_testmod_ops *)kdata)
-               st_ops_trampoline = NULL;
-       mutex_unlock(&st_ops_trampoline_mutex);
  }

  static int bpf_testmod_test_1(void)
```

I will send out the v3 next week if no more comments.

Thanks,
Tiezhu