[PATCH bpf-next v3] selftests/bpf: Fix htab_update/reenter_update selftest failure

[PATCH bpf-next v3] selftests/bpf: Fix htab_update/reenter_update selftest failure

[Saket Kumar Bhaskar]

Since commit 31158ad02ddb ("rqspinlock: Add deadlock detection
and recovery") the updated path on re-entrancy now reports deadlock
via -EDEADLK instead of the previous -EBUSY.

Also, the way reentrancy was exercised (via fentry/lookup_elem_raw)
has been fragile because lookup_elem_raw may be inlined
(find_kernel_btf_id() will return -ESRCH).

To fix this fentry is attached to bpf_obj_free_fields() instead of
lookup_elem_raw() and:

- The htab map is made to use a BTF-described struct val with a
  struct bpf_timer so that check_and_free_fields() reliably calls
  bpf_obj_free_fields() on element replacement.

- The selftest is updated to do two updates to the same key (insert +
  replace) in prog_test.

- The selftest is updated to align with expected errno with the
  kernel’s current behavior.

Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>
---
Changes since v2:
Addressed CI failures:
* Initialize key to 0 before the first update.
* Used pointer value to pass for update and memset rather than
  &value.

v2: https://lore.kernel.org/all/20251114152653.356782-1-skb99@linux.ibm.com/

Changes since v1:
Addressed comments from Alexei:
* Fixed the scenario where test may fail when lookup_elem_raw()
  is inlined.

v1: https://lore.kernel.org/all/20251106052628.349117-1-skb99@linux.ibm.com/

 .../selftests/bpf/prog_tests/htab_update.c    | 37 ++++++++++++++-----
 .../testing/selftests/bpf/progs/htab_update.c | 19 +++++++---
 2 files changed, 41 insertions(+), 15 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/htab_update.c b/tools/testing/selftests/bpf/prog_tests/htab_update.c
index 2bc85f4814f4..d0b405eb2966 100644
--- a/tools/testing/selftests/bpf/prog_tests/htab_update.c
+++ b/tools/testing/selftests/bpf/prog_tests/htab_update.c
@@ -15,17 +15,17 @@ struct htab_update_ctx {
 static void test_reenter_update(void)
 {
 	struct htab_update *skel;
-	unsigned int key, value;
+	void *value = NULL;
+	unsigned int key, value_size;
 	int err;
 
 	skel = htab_update__open();
 	if (!ASSERT_OK_PTR(skel, "htab_update__open"))
 		return;
 
-	/* lookup_elem_raw() may be inlined and find_kernel_btf_id() will return -ESRCH */
-	bpf_program__set_autoload(skel->progs.lookup_elem_raw, true);
+	bpf_program__set_autoload(skel->progs.bpf_obj_free_fields, true);
 	err = htab_update__load(skel);
-	if (!ASSERT_TRUE(!err || err == -ESRCH, "htab_update__load") || err)
+	if (!ASSERT_TRUE(!err, "htab_update__load") || err)
 		goto out;
 
 	skel->bss->pid = getpid();
@@ -33,14 +33,33 @@ static void test_reenter_update(void)
 	if (!ASSERT_OK(err, "htab_update__attach"))
 		goto out;
 
-	/* Will trigger the reentrancy of bpf_map_update_elem() */
+	value_size = bpf_map__value_size(skel->maps.htab);
+
+	value = calloc(1, value_size);
+	if (!ASSERT_OK_PTR(value, "calloc value"))
+		goto out;
+	/*
+	 * First update: plain insert. This should NOT trigger the re-entrancy
+	 * path, because there is no old element to free yet.
+	 */
 	key = 0;
-	value = 0;
-	err = bpf_map_update_elem(bpf_map__fd(skel->maps.htab), &key, &value, 0);
-	if (!ASSERT_OK(err, "add element"))
+	err = bpf_map_update_elem(bpf_map__fd(skel->maps.htab), &key, value, BPF_ANY);
+	if (!ASSERT_OK(err, "first update (insert)"))
+		goto out;
+
+	/*
+	 * Second update: replace existing element with same key and trigger
+	 * the reentrancy of bpf_map_update_elem().
+	 * check_and_free_fields() calls bpf_obj_free_fields() on the old
+	 * value, which is where fentry program runs and performs a nested
+	 * bpf_map_update_elem(), triggering -EDEADLK.
+	 */
+	memset(value, 0, value_size);
+	err = bpf_map_update_elem(bpf_map__fd(skel->maps.htab), &key, value, BPF_ANY);
+	if (!ASSERT_OK(err, "second update (replace)"))
 		goto out;
 
-	ASSERT_EQ(skel->bss->update_err, -EBUSY, "no reentrancy");
+	ASSERT_EQ(skel->bss->update_err, -EDEADLK, "no reentrancy");
 out:
 	htab_update__destroy(skel);
 }
diff --git a/tools/testing/selftests/bpf/progs/htab_update.c b/tools/testing/selftests/bpf/progs/htab_update.c
index 7481bb30b29b..195d3b2fba00 100644
--- a/tools/testing/selftests/bpf/progs/htab_update.c
+++ b/tools/testing/selftests/bpf/progs/htab_update.c
@@ -6,24 +6,31 @@
 
 char _license[] SEC("license") = "GPL";
 
+/* Map value type: has BTF-managed field (bpf_timer) */
+struct val {
+	struct bpf_timer t;
+	__u64 payload;
+};
+
 struct {
 	__uint(type, BPF_MAP_TYPE_HASH);
 	__uint(max_entries, 1);
-	__uint(key_size, sizeof(__u32));
-	__uint(value_size, sizeof(__u32));
+	__type(key, __u32);
+	__type(value, struct val);
 } htab SEC(".maps");
 
 int pid = 0;
 int update_err = 0;
 
-SEC("?fentry/lookup_elem_raw")
-int lookup_elem_raw(void *ctx)
+SEC("?fentry/bpf_obj_free_fields")
+int bpf_obj_free_fields(void *ctx)
 {
-	__u32 key = 0, value = 1;
+	__u32 key = 0;
+	struct val value = { .payload = 1 };
 
 	if ((bpf_get_current_pid_tgid() >> 32) != pid)
 		return 0;
 
-	update_err = bpf_map_update_elem(&htab, &key, &value, 0);
+	update_err = bpf_map_update_elem(&htab, &key, &value, BPF_ANY);
 	return 0;
 }
-- 
2.51.0

Re: [PATCH bpf-next v3] selftests/bpf: Fix htab_update/reenter_update selftest failure

[Venkat]

> On 17 Nov 2025, at 11:37 AM, Saket Kumar Bhaskar <skb99@linux.ibm.com> wrote:
> 
> Since commit 31158ad02ddb ("rqspinlock: Add deadlock detection
> and recovery") the updated path on re-entrancy now reports deadlock
> via -EDEADLK instead of the previous -EBUSY.
> 
> Also, the way reentrancy was exercised (via fentry/lookup_elem_raw)
> has been fragile because lookup_elem_raw may be inlined
> (find_kernel_btf_id() will return -ESRCH).
> 
> To fix this fentry is attached to bpf_obj_free_fields() instead of
> lookup_elem_raw() and:
> 
> - The htab map is made to use a BTF-described struct val with a
>  struct bpf_timer so that check_and_free_fields() reliably calls
>  bpf_obj_free_fields() on element replacement.
> 
> - The selftest is updated to do two updates to the same key (insert +
>  replace) in prog_test.
> 
> - The selftest is updated to align with expected errno with the
>  kernel’s current behavior.
> 
> Signed-off-by: Saket Kumar Bhaskar <skb99@linux.ibm.com>

Tested this patch by applying on top of bpd-next and it works as expected. Please add below tag.

Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>

With this change:

./test_progs -t htab_update
#144/1   htab_update/reenter_update:OK
#144/2   htab_update/concurrent_update:OK
#144     htab_update:OK
Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED

Regards,
Venkat.

> ---
> Changes since v2:
> Addressed CI failures:
> * Initialize key to 0 before the first update.
> * Used pointer value to pass for update and memset rather than
>  &value.
> 
> v2: https://lore.kernel.org/all/20251114152653.356782-1-skb99@linux.ibm.com/
> 
> Changes since v1:
> Addressed comments from Alexei:
> * Fixed the scenario where test may fail when lookup_elem_raw()
>  is inlined.
> 
> v1: https://lore.kernel.org/all/20251106052628.349117-1-skb99@linux.ibm.com/
> 
> .../selftests/bpf/prog_tests/htab_update.c    | 37 ++++++++++++++-----
> .../testing/selftests/bpf/progs/htab_update.c | 19 +++++++---
> 2 files changed, 41 insertions(+), 15 deletions(-)
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/htab_update.c b/tools/testing/selftests/bpf/prog_tests/htab_update.c
> index 2bc85f4814f4..d0b405eb2966 100644
> --- a/tools/testing/selftests/bpf/prog_tests/htab_update.c
> +++ b/tools/testing/selftests/bpf/prog_tests/htab_update.c
> @@ -15,17 +15,17 @@ struct htab_update_ctx {
> static void test_reenter_update(void)
> {
> struct htab_update *skel;
> - unsigned int key, value;
> + void *value = NULL;
> + unsigned int key, value_size;
> int err;
> 
> skel = htab_update__open();
> if (!ASSERT_OK_PTR(skel, "htab_update__open"))
> return;
> 
> - /* lookup_elem_raw() may be inlined and find_kernel_btf_id() will return -ESRCH */
> - bpf_program__set_autoload(skel->progs.lookup_elem_raw, true);
> + bpf_program__set_autoload(skel->progs.bpf_obj_free_fields, true);
> err = htab_update__load(skel);
> - if (!ASSERT_TRUE(!err || err == -ESRCH, "htab_update__load") || err)
> + if (!ASSERT_TRUE(!err, "htab_update__load") || err)
> goto out;
> 
> skel->bss->pid = getpid();
> @@ -33,14 +33,33 @@ static void test_reenter_update(void)
> if (!ASSERT_OK(err, "htab_update__attach"))
> goto out;
> 
> - /* Will trigger the reentrancy of bpf_map_update_elem() */
> + value_size = bpf_map__value_size(skel->maps.htab);
> +
> + value = calloc(1, value_size);
> + if (!ASSERT_OK_PTR(value, "calloc value"))
> + goto out;
> + /*
> + * First update: plain insert. This should NOT trigger the re-entrancy
> + * path, because there is no old element to free yet.
> + */
> key = 0;
> - value = 0;
> - err = bpf_map_update_elem(bpf_map__fd(skel->maps.htab), &key, &value, 0);
> - if (!ASSERT_OK(err, "add element"))
> + err = bpf_map_update_elem(bpf_map__fd(skel->maps.htab), &key, value, BPF_ANY);
> + if (!ASSERT_OK(err, "first update (insert)"))
> + goto out;
> +
> + /*
> + * Second update: replace existing element with same key and trigger
> + * the reentrancy of bpf_map_update_elem().
> + * check_and_free_fields() calls bpf_obj_free_fields() on the old
> + * value, which is where fentry program runs and performs a nested
> + * bpf_map_update_elem(), triggering -EDEADLK.
> + */
> + memset(value, 0, value_size);
> + err = bpf_map_update_elem(bpf_map__fd(skel->maps.htab), &key, value, BPF_ANY);
> + if (!ASSERT_OK(err, "second update (replace)"))
> goto out;
> 
> - ASSERT_EQ(skel->bss->update_err, -EBUSY, "no reentrancy");
> + ASSERT_EQ(skel->bss->update_err, -EDEADLK, "no reentrancy");
> out:
> htab_update__destroy(skel);
> }
> diff --git a/tools/testing/selftests/bpf/progs/htab_update.c b/tools/testing/selftests/bpf/progs/htab_update.c
> index 7481bb30b29b..195d3b2fba00 100644
> --- a/tools/testing/selftests/bpf/progs/htab_update.c
> +++ b/tools/testing/selftests/bpf/progs/htab_update.c
> @@ -6,24 +6,31 @@
> 
> char _license[] SEC("license") = "GPL";
> 
> +/* Map value type: has BTF-managed field (bpf_timer) */
> +struct val {
> + struct bpf_timer t;
> + __u64 payload;
> +};
> +
> struct {
> __uint(type, BPF_MAP_TYPE_HASH);
> __uint(max_entries, 1);
> - __uint(key_size, sizeof(__u32));
> - __uint(value_size, sizeof(__u32));
> + __type(key, __u32);
> + __type(value, struct val);
> } htab SEC(".maps");
> 
> int pid = 0;
> int update_err = 0;
> 
> -SEC("?fentry/lookup_elem_raw")
> -int lookup_elem_raw(void *ctx)
> +SEC("?fentry/bpf_obj_free_fields")
> +int bpf_obj_free_fields(void *ctx)
> {
> - __u32 key = 0, value = 1;
> + __u32 key = 0;
> + struct val value = { .payload = 1 };
> 
> if ((bpf_get_current_pid_tgid() >> 32) != pid)
> return 0;
> 
> - update_err = bpf_map_update_elem(&htab, &key, &value, 0);
> + update_err = bpf_map_update_elem(&htab, &key, &value, BPF_ANY);
> return 0;
> }
> -- 
> 2.51.0

Re: [PATCH bpf-next v3] selftests/bpf: Fix htab_update/reenter_update selftest failure

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Mon, 17 Nov 2025 11:37:52 +0530 you wrote:
> Since commit 31158ad02ddb ("rqspinlock: Add deadlock detection
> and recovery") the updated path on re-entrancy now reports deadlock
> via -EDEADLK instead of the previous -EBUSY.
> 
> Also, the way reentrancy was exercised (via fentry/lookup_elem_raw)
> has been fragile because lookup_elem_raw may be inlined
> (find_kernel_btf_id() will return -ESRCH).
> 
> [...]

Here is the summary with links:
  - [bpf-next,v3] selftests/bpf: Fix htab_update/reenter_update selftest failure
    https://git.kernel.org/bpf/bpf-next/c/590699d85823

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html