[PATCH] selftests/bpf: test accounting of tail calls when prog is NULL

[PATCH] selftests/bpf: test accounting of tail calls when prog is NULL

[Hari Bathini]

Test whether tail call count is incorrectly accounted for, when the
tail call fails due to a missing BPF program.

Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
---

- powerpc64 BPF JIT has been incorrectly accounting for tailcall count
  even when BPF program to tailcall into is missing. A simple change
  to one of the tailcall selftests could have flagged it earlier.

    https://lore.kernel.org/all/20260216065639.1750181-2-hbathini@linux.ibm.com/

 tools/testing/selftests/bpf/progs/tailcall3.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/progs/tailcall3.c b/tools/testing/selftests/bpf/progs/tailcall3.c
index f60bcd7b8d4b..204f19c30a3e 100644
--- a/tools/testing/selftests/bpf/progs/tailcall3.c
+++ b/tools/testing/selftests/bpf/progs/tailcall3.c
@@ -5,7 +5,7 @@
 
 struct {
 	__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
-	__uint(max_entries, 1);
+	__uint(max_entries, 2);
 	__uint(key_size, sizeof(__u32));
 	__uint(value_size, sizeof(__u32));
 } jmp_table SEC(".maps");
@@ -23,6 +23,9 @@ int classifier_0(struct __sk_buff *skb)
 SEC("tc")
 int entry(struct __sk_buff *skb)
 {
+	/* prog == NULL case */
+	bpf_tail_call_static(skb, &jmp_table, 1);
+
 	bpf_tail_call_static(skb, &jmp_table, 0);
 	return 0;
 }
-- 
2.53.0

Re: [PATCH] selftests/bpf: test accounting of tail calls when prog is NULL

[Venkat]

Hello Hari,

With this patch, tailcalls selftest is failing.

# ./test_progs -t tailcalls
tester_init:PASS:tester_log_buf 0 nsec
process_subtest:PASS:obj_open_mem 0 nsec
process_subtest:PASS:specs_alloc 0 nsec
#448/1   tailcalls/tailcall_1:OK
#448/2   tailcalls/tailcall_2:OK
test_tailcall_count:PASS:tailcall 0 nsec
test_tailcall_count:PASS:tailcall retval 0 nsec
test_tailcall_count:PASS:tailcall count 0 nsec
test_tailcall_count:FAIL:tailcall count unexpected tailcall count: actual 32 != expected 33
test_tailcall_count:PASS:tailcall 0 nsec
test_tailcall_count:PASS:tailcall retval 0 nsec
#448/3   tailcalls/tailcall_3:FAIL
#448/4   tailcalls/tailcall_4:OK
#448/5   tailcalls/tailcall_5:OK
#448/6   tailcalls/tailcall_6:OK
#448/7   tailcalls/tailcall_bpf2bpf_1:OK
#448/8   tailcalls/tailcall_bpf2bpf_2:OK
#448/9   tailcalls/tailcall_bpf2bpf_3:OK
#448/10  tailcalls/tailcall_bpf2bpf_4:OK
#448/11  tailcalls/tailcall_bpf2bpf_5:OK
#448/12  tailcalls/tailcall_bpf2bpf_6:OK
#448/13  tailcalls/tailcall_bpf2bpf_fentry:OK
#448/14  tailcalls/tailcall_bpf2bpf_fexit:OK
#448/15  tailcalls/tailcall_bpf2bpf_fentry_fexit:OK
#448/16  tailcalls/tailcall_bpf2bpf_fentry_entry:OK
#448/17  tailcalls/tailcall_poke:OK
#448/18  tailcalls/tailcall_bpf2bpf_hierarchy_1:OK
#448/19  tailcalls/tailcall_bpf2bpf_hierarchy_fentry:OK
#448/20  tailcalls/tailcall_bpf2bpf_hierarchy_fexit:OK
#448/21  tailcalls/tailcall_bpf2bpf_hierarchy_fentry_fexit:OK
#448/22  tailcalls/tailcall_bpf2bpf_hierarchy_fentry_entry:OK
#448/23  tailcalls/tailcall_bpf2bpf_hierarchy_2:OK
#448/24  tailcalls/tailcall_bpf2bpf_hierarchy_3:OK
#448/25  tailcalls/tailcall_freplace:OK
#448/26  tailcalls/tailcall_bpf2bpf_freplace:OK
#448/27  tailcalls/tailcall_failure:OK
#448/28  tailcalls/reject_tail_call_spin_lock:OK
#448/29  tailcalls/reject_tail_call_rcu_lock:OK
#448/30  tailcalls/reject_tail_call_preempt_lock:OK
#448/31  tailcalls/reject_tail_call_ref:OK
#448/32  tailcalls/tailcall_sleepable:OK
#448     tailcalls:FAIL

All error logs:
tester_init:PASS:tester_log_buf 0 nsec
process_subtest:PASS:obj_open_mem 0 nsec
process_subtest:PASS:specs_alloc 0 nsec
test_tailcall_count:PASS:tailcall 0 nsec
test_tailcall_count:PASS:tailcall retval 0 nsec
test_tailcall_count:PASS:tailcall count 0 nsec
test_tailcall_count:FAIL:tailcall count unexpected tailcall count: actual 32 != expected 33
test_tailcall_count:PASS:tailcall 0 nsec
test_tailcall_count:PASS:tailcall retval 0 nsec
#448/3   tailcalls/tailcall_3:FAIL
#448     tailcalls:FAIL
Summary: 0/31 PASSED, 0 SKIPPED, 1 FAILED

Regards,
Venkat.

> On 16 Feb 2026, at 2:38 PM, Hari Bathini <hbathini@linux.ibm.com> wrote:
> 
> Test whether tail call count is incorrectly accounted for, when the
> tail call fails due to a missing BPF program.
> 
> Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
> ---
> 
> - powerpc64 BPF JIT has been incorrectly accounting for tailcall count
>  even when BPF program to tailcall into is missing. A simple change
>  to one of the tailcall selftests could have flagged it earlier.
> 
>    https://lore.kernel.org/all/20260216065639.1750181-2-hbathini@linux.ibm.com/
> 
> tools/testing/selftests/bpf/progs/tailcall3.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/testing/selftests/bpf/progs/tailcall3.c b/tools/testing/selftests/bpf/progs/tailcall3.c
> index f60bcd7b8d4b..204f19c30a3e 100644
> --- a/tools/testing/selftests/bpf/progs/tailcall3.c
> +++ b/tools/testing/selftests/bpf/progs/tailcall3.c
> @@ -5,7 +5,7 @@
> 
> struct {
> __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
> - __uint(max_entries, 1);
> + __uint(max_entries, 2);
> __uint(key_size, sizeof(__u32));
> __uint(value_size, sizeof(__u32));
> } jmp_table SEC(".maps");
> @@ -23,6 +23,9 @@ int classifier_0(struct __sk_buff *skb)
> SEC("tc")
> int entry(struct __sk_buff *skb)
> {
> + /* prog == NULL case */
> + bpf_tail_call_static(skb, &jmp_table, 1);
> +
> bpf_tail_call_static(skb, &jmp_table, 0);
> return 0;
> }
> -- 
> 2.53.0
> 

Re: [PATCH] selftests/bpf: test accounting of tail calls when prog is NULL

[Hari Bathini]

On 16/02/26 4:38 pm, Venkat wrote:
> Hello Hari,
> 
> With this patch, tailcalls selftest is failing.
> 
> # ./test_progs -t tailcalls
> tester_init:PASS:tester_log_buf 0 nsec
> process_subtest:PASS:obj_open_mem 0 nsec
> process_subtest:PASS:specs_alloc 0 nsec
> #448/1   tailcalls/tailcall_1:OK
> #448/2   tailcalls/tailcall_2:OK
> test_tailcall_count:PASS:tailcall 0 nsec
> test_tailcall_count:PASS:tailcall retval 0 nsec
> test_tailcall_count:PASS:tailcall count 0 nsec
> test_tailcall_count:FAIL:tailcall count unexpected tailcall count: actual 32 != expected 33
> test_tailcall_count:PASS:tailcall 0 nsec
> test_tailcall_count:PASS:tailcall retval 0 nsec
> #448/3   tailcalls/tailcall_3:FAIL
> #448/4   tailcalls/tailcall_4:OK
> #448/5   tailcalls/tailcall_5:OK
> #448/6   tailcalls/tailcall_6:OK
> #448/7   tailcalls/tailcall_bpf2bpf_1:OK
> #448/8   tailcalls/tailcall_bpf2bpf_2:OK
> #448/9   tailcalls/tailcall_bpf2bpf_3:OK
> #448/10  tailcalls/tailcall_bpf2bpf_4:OK
> #448/11  tailcalls/tailcall_bpf2bpf_5:OK
> #448/12  tailcalls/tailcall_bpf2bpf_6:OK
> #448/13  tailcalls/tailcall_bpf2bpf_fentry:OK
> #448/14  tailcalls/tailcall_bpf2bpf_fexit:OK
> #448/15  tailcalls/tailcall_bpf2bpf_fentry_fexit:OK
> #448/16  tailcalls/tailcall_bpf2bpf_fentry_entry:OK
> #448/17  tailcalls/tailcall_poke:OK
> #448/18  tailcalls/tailcall_bpf2bpf_hierarchy_1:OK
> #448/19  tailcalls/tailcall_bpf2bpf_hierarchy_fentry:OK
> #448/20  tailcalls/tailcall_bpf2bpf_hierarchy_fexit:OK
> #448/21  tailcalls/tailcall_bpf2bpf_hierarchy_fentry_fexit:OK
> #448/22  tailcalls/tailcall_bpf2bpf_hierarchy_fentry_entry:OK
> #448/23  tailcalls/tailcall_bpf2bpf_hierarchy_2:OK
> #448/24  tailcalls/tailcall_bpf2bpf_hierarchy_3:OK
> #448/25  tailcalls/tailcall_freplace:OK
> #448/26  tailcalls/tailcall_bpf2bpf_freplace:OK
> #448/27  tailcalls/tailcall_failure:OK
> #448/28  tailcalls/reject_tail_call_spin_lock:OK
> #448/29  tailcalls/reject_tail_call_rcu_lock:OK
> #448/30  tailcalls/reject_tail_call_preempt_lock:OK
> #448/31  tailcalls/reject_tail_call_ref:OK
> #448/32  tailcalls/tailcall_sleepable:OK
> #448     tailcalls:FAIL
> 
> All error logs:
> tester_init:PASS:tester_log_buf 0 nsec
> process_subtest:PASS:obj_open_mem 0 nsec
> process_subtest:PASS:specs_alloc 0 nsec
> test_tailcall_count:PASS:tailcall 0 nsec
> test_tailcall_count:PASS:tailcall retval 0 nsec
> test_tailcall_count:PASS:tailcall count 0 nsec
> test_tailcall_count:FAIL:tailcall count unexpected tailcall count: actual 32 != expected 33
> test_tailcall_count:PASS:tailcall 0 nsec
> test_tailcall_count:PASS:tailcall retval 0 nsec
> #448/3   tailcalls/tailcall_3:FAIL
> #448     tailcalls:FAIL
> Summary: 0/31 PASSED, 0 SKIPPED, 1 FAILED
> 
> Regards,
> Venkat.
> 
>> On 16 Feb 2026, at 2:38 PM, Hari Bathini <hbathini@linux.ibm.com> wrote:
>>
>> Test whether tail call count is incorrectly accounted for, when the
>> tail call fails due to a missing BPF program.
>>
>> Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
>> ---
>>
>> - powerpc64 BPF JIT has been incorrectly accounting for tailcall count
>>   even when BPF program to tailcall into is missing. A simple change
>>   to one of the tailcall selftests could have flagged it earlier.
>>

>>     https://lore.kernel.org/all/20260216065639.1750181-2-hbathini@linux.ibm.com/

Hi Venkat,

Can you confirm if the above kernel patch was used or not?

- Hari

Re: [PATCH] selftests/bpf: test accounting of tail calls when prog is NULL

[Venkat Rao Bagalkote]

On 16/02/26 4:41 pm, Hari Bathini wrote:
>
>
> On 16/02/26 4:38 pm, Venkat wrote:
>> Hello Hari,
>>
>> With this patch, tailcalls selftest is failing.
>>
>> # ./test_progs -t tailcalls
>> tester_init:PASS:tester_log_buf 0 nsec
>> process_subtest:PASS:obj_open_mem 0 nsec
>> process_subtest:PASS:specs_alloc 0 nsec
>> #448/1   tailcalls/tailcall_1:OK
>> #448/2   tailcalls/tailcall_2:OK
>> test_tailcall_count:PASS:tailcall 0 nsec
>> test_tailcall_count:PASS:tailcall retval 0 nsec
>> test_tailcall_count:PASS:tailcall count 0 nsec
>> test_tailcall_count:FAIL:tailcall count unexpected tailcall count: 
>> actual 32 != expected 33
>> test_tailcall_count:PASS:tailcall 0 nsec
>> test_tailcall_count:PASS:tailcall retval 0 nsec
>> #448/3   tailcalls/tailcall_3:FAIL
>> #448/4   tailcalls/tailcall_4:OK
>> #448/5   tailcalls/tailcall_5:OK
>> #448/6   tailcalls/tailcall_6:OK
>> #448/7   tailcalls/tailcall_bpf2bpf_1:OK
>> #448/8   tailcalls/tailcall_bpf2bpf_2:OK
>> #448/9   tailcalls/tailcall_bpf2bpf_3:OK
>> #448/10  tailcalls/tailcall_bpf2bpf_4:OK
>> #448/11  tailcalls/tailcall_bpf2bpf_5:OK
>> #448/12  tailcalls/tailcall_bpf2bpf_6:OK
>> #448/13  tailcalls/tailcall_bpf2bpf_fentry:OK
>> #448/14  tailcalls/tailcall_bpf2bpf_fexit:OK
>> #448/15  tailcalls/tailcall_bpf2bpf_fentry_fexit:OK
>> #448/16  tailcalls/tailcall_bpf2bpf_fentry_entry:OK
>> #448/17  tailcalls/tailcall_poke:OK
>> #448/18  tailcalls/tailcall_bpf2bpf_hierarchy_1:OK
>> #448/19  tailcalls/tailcall_bpf2bpf_hierarchy_fentry:OK
>> #448/20  tailcalls/tailcall_bpf2bpf_hierarchy_fexit:OK
>> #448/21  tailcalls/tailcall_bpf2bpf_hierarchy_fentry_fexit:OK
>> #448/22  tailcalls/tailcall_bpf2bpf_hierarchy_fentry_entry:OK
>> #448/23  tailcalls/tailcall_bpf2bpf_hierarchy_2:OK
>> #448/24  tailcalls/tailcall_bpf2bpf_hierarchy_3:OK
>> #448/25  tailcalls/tailcall_freplace:OK
>> #448/26  tailcalls/tailcall_bpf2bpf_freplace:OK
>> #448/27  tailcalls/tailcall_failure:OK
>> #448/28  tailcalls/reject_tail_call_spin_lock:OK
>> #448/29  tailcalls/reject_tail_call_rcu_lock:OK
>> #448/30  tailcalls/reject_tail_call_preempt_lock:OK
>> #448/31  tailcalls/reject_tail_call_ref:OK
>> #448/32  tailcalls/tailcall_sleepable:OK
>> #448     tailcalls:FAIL
>>
>> All error logs:
>> tester_init:PASS:tester_log_buf 0 nsec
>> process_subtest:PASS:obj_open_mem 0 nsec
>> process_subtest:PASS:specs_alloc 0 nsec
>> test_tailcall_count:PASS:tailcall 0 nsec
>> test_tailcall_count:PASS:tailcall retval 0 nsec
>> test_tailcall_count:PASS:tailcall count 0 nsec
>> test_tailcall_count:FAIL:tailcall count unexpected tailcall count: 
>> actual 32 != expected 33
>> test_tailcall_count:PASS:tailcall 0 nsec
>> test_tailcall_count:PASS:tailcall retval 0 nsec
>> #448/3   tailcalls/tailcall_3:FAIL
>> #448     tailcalls:FAIL
>> Summary: 0/31 PASSED, 0 SKIPPED, 1 FAILED
>>
>> Regards,
>> Venkat.
>>
>>> On 16 Feb 2026, at 2:38 PM, Hari Bathini <hbathini@linux.ibm.com> 
>>> wrote:
>>>
>>> Test whether tail call count is incorrectly accounted for, when the
>>> tail call fails due to a missing BPF program.
>>>
>>> Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
>>> ---
>>>
>>> - powerpc64 BPF JIT has been incorrectly accounting for tailcall count
>>>   even when BPF program to tailcall into is missing. A simple change
>>>   to one of the tailcall selftests could have flagged it earlier.
>>>
>
>>> https://lore.kernel.org/all/20260216065639.1750181-2-hbathini@linux.ibm.com/ 
>>>


Above patch was not applied, during the test.

>
> Hi Venkat,
>
> Can you confirm if the above kernel patch was used or not?


Its with only below patch. Please refer git log.


git log
commit cb50b08d0c45e7f97e1364075a5ee399c63422d5 (HEAD -> master)
Author: Hari Bathini <hbathini@linux.ibm.com>
Date:   Mon Feb 16 14:38:02 2026 +0530

     selftests/bpf: test accounting of tail calls when prog is NULL

     Test whether tail call count is incorrectly accounted for, when the
     tail call fails due to a missing BPF program.

     Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>

commit 0f2acd3148e0ef42bdacbd477f90e8533f96b2ac (origin/master, origin/HEAD)
Merge: 26a4cfaff82a a16ac6ca46d6
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Feb 15 19:45:00 2026 -0800


Regards,

Venkat.

>
> - Hari
>

Re: [PATCH] selftests/bpf: test accounting of tail calls when prog is NULL

[Venkat Rao Bagalkote]

On 16/02/26 8:31 pm, Venkat Rao Bagalkote wrote:
>
> On 16/02/26 4:41 pm, Hari Bathini wrote:
>>
>>
>> On 16/02/26 4:38 pm, Venkat wrote:
>>> Hello Hari,
>>>
>>> With this patch, tailcalls selftest is failing.
>>>
>>> # ./test_progs -t tailcalls
>>> tester_init:PASS:tester_log_buf 0 nsec
>>> process_subtest:PASS:obj_open_mem 0 nsec
>>> process_subtest:PASS:specs_alloc 0 nsec
>>> #448/1   tailcalls/tailcall_1:OK
>>> #448/2   tailcalls/tailcall_2:OK
>>> test_tailcall_count:PASS:tailcall 0 nsec
>>> test_tailcall_count:PASS:tailcall retval 0 nsec
>>> test_tailcall_count:PASS:tailcall count 0 nsec
>>> test_tailcall_count:FAIL:tailcall count unexpected tailcall count: 
>>> actual 32 != expected 33
>>> test_tailcall_count:PASS:tailcall 0 nsec
>>> test_tailcall_count:PASS:tailcall retval 0 nsec
>>> #448/3   tailcalls/tailcall_3:FAIL
>>> #448/4   tailcalls/tailcall_4:OK
>>> #448/5   tailcalls/tailcall_5:OK
>>> #448/6   tailcalls/tailcall_6:OK
>>> #448/7   tailcalls/tailcall_bpf2bpf_1:OK
>>> #448/8   tailcalls/tailcall_bpf2bpf_2:OK
>>> #448/9   tailcalls/tailcall_bpf2bpf_3:OK
>>> #448/10  tailcalls/tailcall_bpf2bpf_4:OK
>>> #448/11  tailcalls/tailcall_bpf2bpf_5:OK
>>> #448/12  tailcalls/tailcall_bpf2bpf_6:OK
>>> #448/13  tailcalls/tailcall_bpf2bpf_fentry:OK
>>> #448/14  tailcalls/tailcall_bpf2bpf_fexit:OK
>>> #448/15  tailcalls/tailcall_bpf2bpf_fentry_fexit:OK
>>> #448/16  tailcalls/tailcall_bpf2bpf_fentry_entry:OK
>>> #448/17  tailcalls/tailcall_poke:OK
>>> #448/18  tailcalls/tailcall_bpf2bpf_hierarchy_1:OK
>>> #448/19  tailcalls/tailcall_bpf2bpf_hierarchy_fentry:OK
>>> #448/20  tailcalls/tailcall_bpf2bpf_hierarchy_fexit:OK
>>> #448/21  tailcalls/tailcall_bpf2bpf_hierarchy_fentry_fexit:OK
>>> #448/22  tailcalls/tailcall_bpf2bpf_hierarchy_fentry_entry:OK
>>> #448/23  tailcalls/tailcall_bpf2bpf_hierarchy_2:OK
>>> #448/24  tailcalls/tailcall_bpf2bpf_hierarchy_3:OK
>>> #448/25  tailcalls/tailcall_freplace:OK
>>> #448/26  tailcalls/tailcall_bpf2bpf_freplace:OK
>>> #448/27  tailcalls/tailcall_failure:OK
>>> #448/28  tailcalls/reject_tail_call_spin_lock:OK
>>> #448/29  tailcalls/reject_tail_call_rcu_lock:OK
>>> #448/30  tailcalls/reject_tail_call_preempt_lock:OK
>>> #448/31  tailcalls/reject_tail_call_ref:OK
>>> #448/32  tailcalls/tailcall_sleepable:OK
>>> #448     tailcalls:FAIL
>>>
>>> All error logs:
>>> tester_init:PASS:tester_log_buf 0 nsec
>>> process_subtest:PASS:obj_open_mem 0 nsec
>>> process_subtest:PASS:specs_alloc 0 nsec
>>> test_tailcall_count:PASS:tailcall 0 nsec
>>> test_tailcall_count:PASS:tailcall retval 0 nsec
>>> test_tailcall_count:PASS:tailcall count 0 nsec
>>> test_tailcall_count:FAIL:tailcall count unexpected tailcall count: 
>>> actual 32 != expected 33
>>> test_tailcall_count:PASS:tailcall 0 nsec
>>> test_tailcall_count:PASS:tailcall retval 0 nsec
>>> #448/3   tailcalls/tailcall_3:FAIL
>>> #448     tailcalls:FAIL
>>> Summary: 0/31 PASSED, 0 SKIPPED, 1 FAILED
>>>
>>> Regards,
>>> Venkat.
>>>
>>>> On 16 Feb 2026, at 2:38 PM, Hari Bathini <hbathini@linux.ibm.com> 
>>>> wrote:
>>>>
>>>> Test whether tail call count is incorrectly accounted for, when the
>>>> tail call fails due to a missing BPF program.
>>>>
>>>> Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
>>>> ---
>>>>
>>>> - powerpc64 BPF JIT has been incorrectly accounting for tailcall count
>>>>   even when BPF program to tailcall into is missing. A simple change
>>>>   to one of the tailcall selftests could have flagged it earlier.
>>>>
>>
>>>> https://lore.kernel.org/all/20260216065639.1750181-2-hbathini@linux.ibm.com/ 
>>>>
>
Tested by applying V2 version of above patch series, and tested this 
patch, and the test passes.


Logs:

./test_progs -t tailcalls
#448/1   tailcalls/tailcall_1:OK
#448/2   tailcalls/tailcall_2:OK
#448/3   tailcalls/tailcall_3:OK
#448/4   tailcalls/tailcall_4:OK
#448/5   tailcalls/tailcall_5:OK
#448/6   tailcalls/tailcall_6:OK
#448/7   tailcalls/tailcall_bpf2bpf_1:OK
#448/8   tailcalls/tailcall_bpf2bpf_2:OK
#448/9   tailcalls/tailcall_bpf2bpf_3:OK
#448/10  tailcalls/tailcall_bpf2bpf_4:OK
#448/11  tailcalls/tailcall_bpf2bpf_5:OK
#448/12  tailcalls/tailcall_bpf2bpf_6:OK
#448/13  tailcalls/tailcall_bpf2bpf_fentry:OK
#448/14  tailcalls/tailcall_bpf2bpf_fexit:OK
#448/15  tailcalls/tailcall_bpf2bpf_fentry_fexit:OK
#448/16  tailcalls/tailcall_bpf2bpf_fentry_entry:OK
#448/17  tailcalls/tailcall_poke:OK
#448/18  tailcalls/tailcall_bpf2bpf_hierarchy_1:OK
#448/19  tailcalls/tailcall_bpf2bpf_hierarchy_fentry:OK
#448/20  tailcalls/tailcall_bpf2bpf_hierarchy_fexit:OK
#448/21  tailcalls/tailcall_bpf2bpf_hierarchy_fentry_fexit:OK
#448/22  tailcalls/tailcall_bpf2bpf_hierarchy_fentry_entry:OK
#448/23  tailcalls/tailcall_bpf2bpf_hierarchy_2:OK
#448/24  tailcalls/tailcall_bpf2bpf_hierarchy_3:OK
#448/25  tailcalls/tailcall_freplace:OK
#448/26  tailcalls/tailcall_bpf2bpf_freplace:OK
#448/27  tailcalls/tailcall_failure:OK
#448/28  tailcalls/reject_tail_call_spin_lock:OK
#448/29  tailcalls/reject_tail_call_rcu_lock:OK
#448/30  tailcalls/reject_tail_call_preempt_lock:OK
#448/31  tailcalls/reject_tail_call_ref:OK
#448/32  tailcalls/tailcall_sleepable:OK
#448     tailcalls:OK
Summary: 1/32 PASSED, 0 SKIPPED, 0 FAILED


Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>



My bad, I didnt apply the related patches, when I tested earlier.


Regards,

Venkat.

>
> Above patch was not applied, during the test.
>
>>
>> Hi Venkat,
>>
>> Can you confirm if the above kernel patch was used or not?
>
>
> Its with only below patch. Please refer git log.
>
>
> git log
> commit cb50b08d0c45e7f97e1364075a5ee399c63422d5 (HEAD -> master)
> Author: Hari Bathini <hbathini@linux.ibm.com>
> Date:   Mon Feb 16 14:38:02 2026 +0530
>
>     selftests/bpf: test accounting of tail calls when prog is NULL
>
>     Test whether tail call count is incorrectly accounted for, when the
>     tail call fails due to a missing BPF program.
>
>     Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
>
> commit 0f2acd3148e0ef42bdacbd477f90e8533f96b2ac (origin/master, 
> origin/HEAD)
> Merge: 26a4cfaff82a a16ac6ca46d6
> Author: Linus Torvalds <torvalds@linux-foundation.org>
> Date:   Sun Feb 15 19:45:00 2026 -0800
>
>
> Regards,
>
> Venkat.
>
>>
>> - Hari
>>

Re: [PATCH] selftests/bpf: test accounting of tail calls when prog is NULL

[Ilya Leoshkevich]

On 2/16/26 10:08, Hari Bathini wrote:
> Test whether tail call count is incorrectly accounted for, when the
> tail call fails due to a missing BPF program.
>
> Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
> ---
>
> - powerpc64 BPF JIT has been incorrectly accounting for tailcall count
>    even when BPF program to tailcall into is missing. A simple change
>    to one of the tailcall selftests could have flagged it earlier.
>
>      https://lore.kernel.org/all/20260216065639.1750181-2-hbathini@linux.ibm.com/
>
>   tools/testing/selftests/bpf/progs/tailcall3.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/bpf/progs/tailcall3.c b/tools/testing/selftests/bpf/progs/tailcall3.c
> index f60bcd7b8d4b..204f19c30a3e 100644
> --- a/tools/testing/selftests/bpf/progs/tailcall3.c
> +++ b/tools/testing/selftests/bpf/progs/tailcall3.c
> @@ -5,7 +5,7 @@
>   
>   struct {
>   	__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
> -	__uint(max_entries, 1);
> +	__uint(max_entries, 2);
>   	__uint(key_size, sizeof(__u32));
>   	__uint(value_size, sizeof(__u32));
>   } jmp_table SEC(".maps");
> @@ -23,6 +23,9 @@ int classifier_0(struct __sk_buff *skb)
>   SEC("tc")
>   int entry(struct __sk_buff *skb)
>   {
> +	/* prog == NULL case */
> +	bpf_tail_call_static(skb, &jmp_table, 1);
> +
>   	bpf_tail_call_static(skb, &jmp_table, 0);
>   	return 0;
>   }

Seems like the x86_64 JIT passes this already, but the interpreter still 
has:

         if (unlikely(tail_call_cnt >= MAX_TAIL_CALL_CNT))
             goto out;

         tail_call_cnt++;

         prog = READ_ONCE(array->ptrs[index]);
         if (!prog)
             goto out;

Should it be changed too? Regardless:

Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>

Re: [PATCH] selftests/bpf: test accounting of tail calls when prog is NULL

[Hari Bathini]

On 17/02/26 6:23 pm, Ilya Leoshkevich wrote:
> 
> On 2/16/26 10:08, Hari Bathini wrote:
>> Test whether tail call count is incorrectly accounted for, when the
>> tail call fails due to a missing BPF program.
>>
>> Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
>> ---
>>
>> - powerpc64 BPF JIT has been incorrectly accounting for tailcall count
>>    even when BPF program to tailcall into is missing. A simple change
>>    to one of the tailcall selftests could have flagged it earlier.
>>
>>      https://lore.kernel.org/all/20260216065639.1750181-2- 
>> hbathini@linux.ibm.com/
>>
>>   tools/testing/selftests/bpf/progs/tailcall3.c | 5 ++++-
>>   1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/tools/testing/selftests/bpf/progs/tailcall3.c b/tools/ 
>> testing/selftests/bpf/progs/tailcall3.c
>> index f60bcd7b8d4b..204f19c30a3e 100644
>> --- a/tools/testing/selftests/bpf/progs/tailcall3.c
>> +++ b/tools/testing/selftests/bpf/progs/tailcall3.c
>> @@ -5,7 +5,7 @@
>>   struct {
>>       __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
>> -    __uint(max_entries, 1);
>> +    __uint(max_entries, 2);
>>       __uint(key_size, sizeof(__u32));
>>       __uint(value_size, sizeof(__u32));
>>   } jmp_table SEC(".maps");
>> @@ -23,6 +23,9 @@ int classifier_0(struct __sk_buff *skb)
>>   SEC("tc")
>>   int entry(struct __sk_buff *skb)
>>   {
>> +    /* prog == NULL case */
>> +    bpf_tail_call_static(skb, &jmp_table, 1);
>> +
>>       bpf_tail_call_static(skb, &jmp_table, 0);
>>       return 0;
>>   }
> 
> Seems like the x86_64 JIT passes this already, but the interpreter still 
> has:
> 
>          if (unlikely(tail_call_cnt >= MAX_TAIL_CALL_CNT))
>              goto out;
> 
>          tail_call_cnt++;
> 
>          prog = READ_ONCE(array->ptrs[index]);
>          if (!prog)
>              goto out;
> 
> Should it be changed too? Regardless:

Yeah, I guess. Posted 
https://lore.kernel.org/bpf/20260220062959.195101-1-hbathini@linux.ibm.com/

> 
> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>

Thanks, Ilya.

- Hari

Re: [PATCH] selftests/bpf: test accounting of tail calls when prog is NULL

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Mon, 16 Feb 2026 14:38:02 +0530 you wrote:
> Test whether tail call count is incorrectly accounted for, when the
> tail call fails due to a missing BPF program.
> 
> Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
> ---
> 
> - powerpc64 BPF JIT has been incorrectly accounting for tailcall count
>   even when BPF program to tailcall into is missing. A simple change
>   to one of the tailcall selftests could have flagged it earlier.
> 
> [...]

Here is the summary with links:
  - selftests/bpf: test accounting of tail calls when prog is NULL
    https://git.kernel.org/bpf/bpf-next/c/8ebfe65e22d5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html