* [PATCH bpf v2 01/15] selftests/bpf: Pass through build flags to bpftool and resolve_btfids
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 02/15] resolve_btfids: Fix memory leaks reported by ASAN Ihor Solodrai
` (13 subsequent siblings)
14 siblings, 0 replies; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
EXTRA_* and SAN_* build flags were not correctly propagated to bpftool
and resolve_btids when building selftests/bpf. This led to various
build errors on attempt to build with SAN_CFLAGS="-fsanitize=address",
for example.
Fix the makefiles to address this:
- Pass SAN_CFLAGS/SAN_LDFLAGS to bpftool and resolve_btfids build
- Propagate EXTRA_LDFLAGS to resolve_btfids link command
- Use pkg-config to detect zlib and zstd for resolve_btfids, similar
libelf handling
Also check for ASAN flag in selftests/bpf/Makefile for convenience.
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
tools/bpf/resolve_btfids/Makefile | 7 +++++--
tools/testing/selftests/bpf/Makefile | 13 +++++++++----
2 files changed, 14 insertions(+), 6 deletions(-)
diff --git a/tools/bpf/resolve_btfids/Makefile b/tools/bpf/resolve_btfids/Makefile
index 1733a6e93a07..ef083602b73a 100644
--- a/tools/bpf/resolve_btfids/Makefile
+++ b/tools/bpf/resolve_btfids/Makefile
@@ -65,6 +65,9 @@ $(BPFOBJ): $(wildcard $(LIBBPF_SRC)/*.[ch] $(LIBBPF_SRC)/Makefile) | $(LIBBPF_OU
LIBELF_FLAGS := $(shell $(HOSTPKG_CONFIG) libelf --cflags 2>/dev/null)
LIBELF_LIBS := $(shell $(HOSTPKG_CONFIG) libelf --libs 2>/dev/null || echo -lelf)
+ZLIB_LIBS := $(shell $(HOSTPKG_CONFIG) zlib --libs 2>/dev/null || echo -lz)
+ZSTD_LIBS := $(shell $(HOSTPKG_CONFIG) libzstd --libs 2>/dev/null || echo -lzstd)
+
HOSTCFLAGS_resolve_btfids += -g \
-I$(srctree)/tools/include \
-I$(srctree)/tools/include/uapi \
@@ -73,7 +76,7 @@ HOSTCFLAGS_resolve_btfids += -g \
$(LIBELF_FLAGS) \
-Wall -Werror
-LIBS = $(LIBELF_LIBS) -lz
+LIBS = $(LIBELF_LIBS) $(ZLIB_LIBS) $(ZSTD_LIBS)
export srctree OUTPUT HOSTCFLAGS_resolve_btfids Q HOSTCC HOSTLD HOSTAR
include $(srctree)/tools/build/Makefile.include
@@ -83,7 +86,7 @@ $(BINARY_IN): fixdep FORCE prepare | $(OUTPUT)
$(BINARY): $(BPFOBJ) $(SUBCMDOBJ) $(BINARY_IN)
$(call msg,LINK,$@)
- $(Q)$(HOSTCC) $(BINARY_IN) $(KBUILD_HOSTLDFLAGS) -o $@ $(BPFOBJ) $(SUBCMDOBJ) $(LIBS)
+ $(Q)$(HOSTCC) $(BINARY_IN) $(KBUILD_HOSTLDFLAGS) $(EXTRA_LDFLAGS) -o $@ $(BPFOBJ) $(SUBCMDOBJ) $(LIBS)
clean_objects := $(wildcard $(OUTPUT)/*.o \
$(OUTPUT)/.*.o.cmd \
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index c6bf4dfb1495..24f4ddb3783a 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -27,7 +27,11 @@ ifneq ($(wildcard $(GENHDR)),)
endif
BPF_GCC ?= $(shell command -v bpf-gcc;)
+ifdef ASAN
+SAN_CFLAGS ?= -fsanitize=address -fno-omit-frame-pointer
+else
SAN_CFLAGS ?=
+endif
SAN_LDFLAGS ?= $(SAN_CFLAGS)
RELEASE ?=
OPT_FLAGS ?= $(if $(RELEASE),-O2,-O0)
@@ -326,8 +330,8 @@ $(DEFAULT_BPFTOOL): $(wildcard $(BPFTOOLDIR)/*.[ch] $(BPFTOOLDIR)/Makefile) \
$(HOST_BPFOBJ) | $(HOST_BUILD_DIR)/bpftool
$(Q)$(MAKE) $(submake_extras) -C $(BPFTOOLDIR) \
ARCH= CROSS_COMPILE= CC="$(HOSTCC)" LD="$(HOSTLD)" \
- EXTRA_CFLAGS='-g $(OPT_FLAGS) $(EXTRA_CFLAGS)' \
- EXTRA_LDFLAGS='$(EXTRA_LDFLAGS)' \
+ EXTRA_CFLAGS='-g $(OPT_FLAGS) $(SAN_CFLAGS) $(EXTRA_CFLAGS)' \
+ EXTRA_LDFLAGS='$(SAN_LDFLAGS) $(EXTRA_LDFLAGS)' \
OUTPUT=$(HOST_BUILD_DIR)/bpftool/ \
LIBBPF_OUTPUT=$(HOST_BUILD_DIR)/libbpf/ \
LIBBPF_DESTDIR=$(HOST_SCRATCH_DIR)/ \
@@ -338,8 +342,8 @@ $(CROSS_BPFTOOL): $(wildcard $(BPFTOOLDIR)/*.[ch] $(BPFTOOLDIR)/Makefile) \
$(BPFOBJ) | $(BUILD_DIR)/bpftool
$(Q)$(MAKE) $(submake_extras) -C $(BPFTOOLDIR) \
ARCH=$(ARCH) CROSS_COMPILE=$(CROSS_COMPILE) \
- EXTRA_CFLAGS='-g $(OPT_FLAGS) $(EXTRA_CFLAGS)' \
- EXTRA_LDFLAGS='$(EXTRA_LDFLAGS)' \
+ EXTRA_CFLAGS='-g $(OPT_FLAGS) $(SAN_CFLAGS) $(EXTRA_CFLAGS)' \
+ EXTRA_LDFLAGS='$(SAN_LDFLAGS) $(EXTRA_LDFLAGS)' \
OUTPUT=$(BUILD_DIR)/bpftool/ \
LIBBPF_OUTPUT=$(BUILD_DIR)/libbpf/ \
LIBBPF_DESTDIR=$(SCRATCH_DIR)/ \
@@ -404,6 +408,7 @@ $(RESOLVE_BTFIDS): $(HOST_BPFOBJ) | $(HOST_BUILD_DIR)/resolve_btfids \
$(Q)$(MAKE) $(submake_extras) -C $(TOOLSDIR)/bpf/resolve_btfids \
CC="$(HOSTCC)" LD="$(HOSTLD)" AR="$(HOSTAR)" \
LIBBPF_INCLUDE=$(HOST_INCLUDE_DIR) \
+ EXTRA_LDFLAGS='$(SAN_LDFLAGS) $(EXTRA_LDFLAGS)' \
OUTPUT=$(HOST_BUILD_DIR)/resolve_btfids/ BPFOBJ=$(HOST_BPFOBJ)
# Get Clang's default includes on this system, as opposed to those seen by
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH bpf v2 02/15] resolve_btfids: Fix memory leaks reported by ASAN
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 01/15] selftests/bpf: Pass through build flags to bpftool and resolve_btfids Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 03/15] selftests/bpf: Add DENYLIST.asan Ihor Solodrai
` (12 subsequent siblings)
14 siblings, 0 replies; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
Running resolve_btfids with ASAN reveals memory leaks in btf_id
handling.
- Change get_id() to use a local buffer
- Make btf_id__add() strdup the name internally
- Add btf_id__free_all() that frees all nodese of a tree
- Call the cleanup function on exit for every tree
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
tools/bpf/resolve_btfids/main.c | 81 ++++++++++++++++++++++-----------
1 file changed, 54 insertions(+), 27 deletions(-)
diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c
index ca7fcd03efb6..5208f650080f 100644
--- a/tools/bpf/resolve_btfids/main.c
+++ b/tools/bpf/resolve_btfids/main.c
@@ -226,7 +226,7 @@ static struct btf_id *btf_id__find(struct rb_root *root, const char *name)
}
static struct btf_id *__btf_id__add(struct rb_root *root,
- char *name,
+ const char *name,
enum btf_id_kind kind,
bool unique)
{
@@ -250,7 +250,11 @@ static struct btf_id *__btf_id__add(struct rb_root *root,
id = zalloc(sizeof(*id));
if (id) {
pr_debug("adding symbol %s\n", name);
- id->name = name;
+ id->name = strdup(name);
+ if (!id->name) {
+ free(id);
+ return NULL;
+ }
id->kind = kind;
rb_link_node(&id->rb_node, parent, p);
rb_insert_color(&id->rb_node, root);
@@ -258,17 +262,21 @@ static struct btf_id *__btf_id__add(struct rb_root *root,
return id;
}
-static inline struct btf_id *btf_id__add(struct rb_root *root, char *name, enum btf_id_kind kind)
+static inline struct btf_id *btf_id__add(struct rb_root *root,
+ const char *name,
+ enum btf_id_kind kind)
{
return __btf_id__add(root, name, kind, false);
}
-static inline struct btf_id *btf_id__add_unique(struct rb_root *root, char *name, enum btf_id_kind kind)
+static inline struct btf_id *btf_id__add_unique(struct rb_root *root,
+ const char *name,
+ enum btf_id_kind kind)
{
return __btf_id__add(root, name, kind, true);
}
-static char *get_id(const char *prefix_end)
+static int get_id(const char *prefix_end, char *buf, size_t buf_sz)
{
/*
* __BTF_ID__func__vfs_truncate__0
@@ -277,28 +285,28 @@ static char *get_id(const char *prefix_end)
*/
int len = strlen(prefix_end);
int pos = sizeof("__") - 1;
- char *p, *id;
+ char *p;
if (pos >= len)
- return NULL;
+ return -1;
- id = strdup(prefix_end + pos);
- if (id) {
- /*
- * __BTF_ID__func__vfs_truncate__0
- * id = ^
- *
- * cut the unique id part
- */
- p = strrchr(id, '_');
- p--;
- if (*p != '_') {
- free(id);
- return NULL;
- }
- *p = '\0';
- }
- return id;
+ if (len - pos >= buf_sz)
+ return -1;
+
+ strcpy(buf, prefix_end + pos);
+ /*
+ * __BTF_ID__func__vfs_truncate__0
+ * buf = ^
+ *
+ * cut the unique id part
+ */
+ p = strrchr(buf, '_');
+ p--;
+ if (*p != '_')
+ return -1;
+ *p = '\0';
+
+ return 0;
}
static struct btf_id *add_set(struct object *obj, char *name, enum btf_id_kind kind)
@@ -335,10 +343,9 @@ static struct btf_id *add_set(struct object *obj, char *name, enum btf_id_kind k
static struct btf_id *add_symbol(struct rb_root *root, char *name, size_t size)
{
- char *id;
+ char id[KSYM_NAME_LEN];
- id = get_id(name + size);
- if (!id) {
+ if (get_id(name + size, id, sizeof(id))) {
pr_err("FAILED to parse symbol name: %s\n", name);
return NULL;
}
@@ -346,6 +353,21 @@ static struct btf_id *add_symbol(struct rb_root *root, char *name, size_t size)
return btf_id__add(root, id, BTF_ID_KIND_SYM);
}
+static void btf_id__free_all(struct rb_root *root)
+{
+ struct rb_node *next;
+ struct btf_id *id;
+
+ next = rb_first(root);
+ while (next) {
+ id = rb_entry(next, struct btf_id, rb_node);
+ next = rb_next(&id->rb_node);
+ rb_erase(&id->rb_node, root);
+ free(id->name);
+ free(id);
+ }
+}
+
static void bswap_32_data(void *data, u32 nr_bytes)
{
u32 cnt, i;
@@ -1547,6 +1569,11 @@ int main(int argc, const char **argv)
out:
btf__free(obj.base_btf);
btf__free(obj.btf);
+ btf_id__free_all(&obj.structs);
+ btf_id__free_all(&obj.unions);
+ btf_id__free_all(&obj.typedefs);
+ btf_id__free_all(&obj.funcs);
+ btf_id__free_all(&obj.sets);
if (obj.efile.elf) {
elf_end(obj.efile.elf);
close(obj.efile.fd);
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH bpf v2 03/15] selftests/bpf: Add DENYLIST.asan
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 01/15] selftests/bpf: Pass through build flags to bpftool and resolve_btfids Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 02/15] resolve_btfids: Fix memory leaks reported by ASAN Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 04/15] selftests/bpf: Refactor bpf_get_ksyms() trace helper Ihor Solodrai
` (11 subsequent siblings)
14 siblings, 0 replies; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
Add a denylist file for tests that should be skipped when built with
userspace ASAN:
$ make ... SAN_CFLAGS="-fsanitize=address -fno-omit-frame-pointer"
Skip the following tests:
- *arena*: userspace ASAN does not understand BPF arena maps and gets
confused particularly when map_extra is non-zero
- non-zero map_extra leads to mmap with MAP_FIXED, and ASAN treats
this as an unknown memory region
- task_local_data: ASAN complains about "incorrect" aligned_alloc()
usage, but it's intentional in the test
- uprobe_multi_test: very slow with ASAN enabled
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
tools/testing/selftests/bpf/DENYLIST.asan | 3 +++
1 file changed, 3 insertions(+)
create mode 100644 tools/testing/selftests/bpf/DENYLIST.asan
diff --git a/tools/testing/selftests/bpf/DENYLIST.asan b/tools/testing/selftests/bpf/DENYLIST.asan
new file mode 100644
index 000000000000..d7fe372a2293
--- /dev/null
+++ b/tools/testing/selftests/bpf/DENYLIST.asan
@@ -0,0 +1,3 @@
+*arena*
+task_local_data
+uprobe_multi_test
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH bpf v2 04/15] selftests/bpf: Refactor bpf_get_ksyms() trace helper
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
` (2 preceding siblings ...)
2026-02-18 0:30 ` [PATCH bpf v2 03/15] selftests/bpf: Add DENYLIST.asan Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 05/15] selftests/bpf: Fix memory leaks in tests Ihor Solodrai
` (10 subsequent siblings)
14 siblings, 0 replies; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
ASAN reported a memory leak in bpf_get_ksyms(): it allocates a struct
ksyms internally and never frees it.
Move struct ksyms to trace_helpers.h and return it from the
bpf_get_ksyms(), giving ownership to the caller. Add filtered_syms and
filtered_cnt fields to the ksyms to hold the filtered array of
symbols, previously returned by bpf_get_ksyms().
Fixup the call sites: kprobe_multi_test and bench_trigger.
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
.../selftests/bpf/benchs/bench_trigger.c | 14 ++++++-----
.../bpf/prog_tests/kprobe_multi_test.c | 12 ++++------
tools/testing/selftests/bpf/trace_helpers.c | 23 ++++++++++---------
tools/testing/selftests/bpf/trace_helpers.h | 11 +++++++--
4 files changed, 34 insertions(+), 26 deletions(-)
diff --git a/tools/testing/selftests/bpf/benchs/bench_trigger.c b/tools/testing/selftests/bpf/benchs/bench_trigger.c
index aeec9edd3851..f74b313d6ae4 100644
--- a/tools/testing/selftests/bpf/benchs/bench_trigger.c
+++ b/tools/testing/selftests/bpf/benchs/bench_trigger.c
@@ -230,8 +230,8 @@ static void trigger_fentry_setup(void)
static void attach_ksyms_all(struct bpf_program *empty, bool kretprobe)
{
LIBBPF_OPTS(bpf_kprobe_multi_opts, opts);
- char **syms = NULL;
- size_t cnt = 0;
+ struct bpf_link *link = NULL;
+ struct ksyms *ksyms = NULL;
/* Some recursive functions will be skipped in
* bpf_get_ksyms -> skip_entry, as they can introduce sufficient
@@ -241,16 +241,18 @@ static void attach_ksyms_all(struct bpf_program *empty, bool kretprobe)
* So, don't run the kprobe-multi-all and kretprobe-multi-all on
* a debug kernel.
*/
- if (bpf_get_ksyms(&syms, &cnt, true)) {
+ if (bpf_get_ksyms(&ksyms, true)) {
fprintf(stderr, "failed to get ksyms\n");
exit(1);
}
- opts.syms = (const char **) syms;
- opts.cnt = cnt;
+ opts.syms = (const char **)ksyms->filtered_syms;
+ opts.cnt = ksyms->filtered_cnt;
opts.retprobe = kretprobe;
/* attach empty to all the kernel functions except bpf_get_numa_node_id. */
- if (!bpf_program__attach_kprobe_multi_opts(empty, NULL, &opts)) {
+ link = bpf_program__attach_kprobe_multi_opts(empty, NULL, &opts);
+ free_kallsyms_local(ksyms);
+ if (!link) {
fprintf(stderr, "failed to attach bpf_program__attach_kprobe_multi_opts to all\n");
exit(1);
}
diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
index 9caef222e528..f81dcd609ee9 100644
--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
@@ -456,25 +456,23 @@ static void test_kprobe_multi_bench_attach(bool kernel)
{
LIBBPF_OPTS(bpf_kprobe_multi_opts, opts);
struct kprobe_multi_empty *skel = NULL;
- char **syms = NULL;
- size_t cnt = 0;
+ struct ksyms *ksyms = NULL;
- if (!ASSERT_OK(bpf_get_ksyms(&syms, &cnt, kernel), "bpf_get_ksyms"))
+ if (!ASSERT_OK(bpf_get_ksyms(&ksyms, kernel), "bpf_get_ksyms"))
return;
skel = kprobe_multi_empty__open_and_load();
if (!ASSERT_OK_PTR(skel, "kprobe_multi_empty__open_and_load"))
goto cleanup;
- opts.syms = (const char **) syms;
- opts.cnt = cnt;
+ opts.syms = (const char **)ksyms->filtered_syms;
+ opts.cnt = ksyms->filtered_cnt;
do_bench_test(skel, &opts);
cleanup:
kprobe_multi_empty__destroy(skel);
- if (syms)
- free(syms);
+ free_kallsyms_local(ksyms);
}
static void test_kprobe_multi_bench_attach_addr(bool kernel)
diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c
index eeaab7013ca2..0e63daf83ed5 100644
--- a/tools/testing/selftests/bpf/trace_helpers.c
+++ b/tools/testing/selftests/bpf/trace_helpers.c
@@ -24,12 +24,6 @@
#define TRACEFS_PIPE "/sys/kernel/tracing/trace_pipe"
#define DEBUGFS_PIPE "/sys/kernel/debug/tracing/trace_pipe"
-struct ksyms {
- struct ksym *syms;
- size_t sym_cap;
- size_t sym_cnt;
-};
-
static struct ksyms *ksyms;
static pthread_mutex_t ksyms_mutex = PTHREAD_MUTEX_INITIALIZER;
@@ -54,6 +48,8 @@ void free_kallsyms_local(struct ksyms *ksyms)
if (!ksyms)
return;
+ free(ksyms->filtered_syms);
+
if (!ksyms->syms) {
free(ksyms);
return;
@@ -610,7 +606,7 @@ static int search_kallsyms_compare(const void *p1, const struct ksym *p2)
return compare_name(p1, p2->name);
}
-int bpf_get_ksyms(char ***symsp, size_t *cntp, bool kernel)
+int bpf_get_ksyms(struct ksyms **ksymsp, bool kernel)
{
size_t cap = 0, cnt = 0;
char *name = NULL, *ksym_name, **syms = NULL;
@@ -637,8 +633,10 @@ int bpf_get_ksyms(char ***symsp, size_t *cntp, bool kernel)
else
f = fopen("/sys/kernel/debug/tracing/available_filter_functions", "r");
- if (!f)
+ if (!f) {
+ free_kallsyms_local(ksyms);
return -EINVAL;
+ }
map = hashmap__new(symbol_hash, symbol_equal, NULL);
if (IS_ERR(map)) {
@@ -679,15 +677,18 @@ int bpf_get_ksyms(char ***symsp, size_t *cntp, bool kernel)
syms[cnt++] = ksym_name;
}
- *symsp = syms;
- *cntp = cnt;
+ ksyms->filtered_syms = syms;
+ ksyms->filtered_cnt = cnt;
+ *ksymsp = ksyms;
error:
free(name);
fclose(f);
hashmap__free(map);
- if (err)
+ if (err) {
free(syms);
+ free_kallsyms_local(ksyms);
+ }
return err;
}
diff --git a/tools/testing/selftests/bpf/trace_helpers.h b/tools/testing/selftests/bpf/trace_helpers.h
index a5576b2dfc26..d5bf1433675d 100644
--- a/tools/testing/selftests/bpf/trace_helpers.h
+++ b/tools/testing/selftests/bpf/trace_helpers.h
@@ -23,7 +23,14 @@ struct ksym {
long addr;
char *name;
};
-struct ksyms;
+
+struct ksyms {
+ struct ksym *syms;
+ size_t sym_cap;
+ size_t sym_cnt;
+ char **filtered_syms;
+ size_t filtered_cnt;
+};
typedef int (*ksym_cmp_t)(const void *p1, const void *p2);
typedef int (*ksym_search_cmp_t)(const void *p1, const struct ksym *p2);
@@ -53,7 +60,7 @@ ssize_t get_rel_offset(uintptr_t addr);
int read_build_id(const char *path, char *build_id, size_t size);
-int bpf_get_ksyms(char ***symsp, size_t *cntp, bool kernel);
+int bpf_get_ksyms(struct ksyms **ksymsp, bool kernel);
int bpf_get_addrs(unsigned long **addrsp, size_t *cntp, bool kernel);
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH bpf v2 05/15] selftests/bpf: Fix memory leaks in tests
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
` (3 preceding siblings ...)
2026-02-18 0:30 ` [PATCH bpf v2 04/15] selftests/bpf: Refactor bpf_get_ksyms() trace helper Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-19 23:58 ` Eduard Zingerman
2026-02-18 0:30 ` [PATCH bpf v2 06/15] selftests/bpf: Fix cleanup in check_fd_array_cnt__fd_array_too_big() Ihor Solodrai
` (9 subsequent siblings)
14 siblings, 1 reply; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
Fix trivial memory leaks detected by userspace ASAN:
- htab_update: free value buffer in test_reenter_update cleanup
- test_xsk: inline pkt_stream_replace() in testapp_stats_rx_full()
and testapp_stats_fill_empty()
- testing_helpers: free buffer allocated by getline() in
parse_test_list_file
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
.../selftests/bpf/prog_tests/htab_update.c | 1 +
.../selftests/bpf/prog_tests/test_xsk.c | 24 +++++++++++++++----
tools/testing/selftests/bpf/testing_helpers.c | 1 +
3 files changed, 22 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/htab_update.c b/tools/testing/selftests/bpf/prog_tests/htab_update.c
index d0b405eb2966..ea1a6766fbe9 100644
--- a/tools/testing/selftests/bpf/prog_tests/htab_update.c
+++ b/tools/testing/selftests/bpf/prog_tests/htab_update.c
@@ -61,6 +61,7 @@ static void test_reenter_update(void)
ASSERT_EQ(skel->bss->update_err, -EDEADLK, "no reentrancy");
out:
+ free(value);
htab_update__destroy(skel);
}
diff --git a/tools/testing/selftests/bpf/prog_tests/test_xsk.c b/tools/testing/selftests/bpf/prog_tests/test_xsk.c
index bab4a31621c7..7e38ec6e656b 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_xsk.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_xsk.c
@@ -2003,9 +2003,17 @@ int testapp_stats_tx_invalid_descs(struct test_spec *test)
int testapp_stats_rx_full(struct test_spec *test)
{
- if (pkt_stream_replace(test, DEFAULT_UMEM_BUFFERS + DEFAULT_UMEM_BUFFERS / 2, MIN_PKT_SIZE))
+ struct pkt_stream *tmp;
+
+ tmp = pkt_stream_generate(DEFAULT_UMEM_BUFFERS + DEFAULT_UMEM_BUFFERS / 2, MIN_PKT_SIZE);
+ if (!tmp)
+ return TEST_FAILURE;
+ test->ifobj_tx->xsk->pkt_stream = tmp;
+
+ tmp = pkt_stream_generate(DEFAULT_UMEM_BUFFERS, MIN_PKT_SIZE);
+ if (!tmp)
return TEST_FAILURE;
- test->ifobj_rx->xsk->pkt_stream = pkt_stream_generate(DEFAULT_UMEM_BUFFERS, MIN_PKT_SIZE);
+ test->ifobj_rx->xsk->pkt_stream = tmp;
test->ifobj_rx->xsk->rxqsize = DEFAULT_UMEM_BUFFERS;
test->ifobj_rx->release_rx = false;
@@ -2015,9 +2023,17 @@ int testapp_stats_rx_full(struct test_spec *test)
int testapp_stats_fill_empty(struct test_spec *test)
{
- if (pkt_stream_replace(test, DEFAULT_UMEM_BUFFERS + DEFAULT_UMEM_BUFFERS / 2, MIN_PKT_SIZE))
+ struct pkt_stream *tmp;
+
+ tmp = pkt_stream_generate(DEFAULT_UMEM_BUFFERS + DEFAULT_UMEM_BUFFERS / 2, MIN_PKT_SIZE);
+ if (!tmp)
+ return TEST_FAILURE;
+ test->ifobj_tx->xsk->pkt_stream = tmp;
+
+ tmp = pkt_stream_generate(DEFAULT_UMEM_BUFFERS, MIN_PKT_SIZE);
+ if (!tmp)
return TEST_FAILURE;
- test->ifobj_rx->xsk->pkt_stream = pkt_stream_generate(DEFAULT_UMEM_BUFFERS, MIN_PKT_SIZE);
+ test->ifobj_rx->xsk->pkt_stream = tmp;
test->ifobj_rx->use_fill_ring = false;
test->ifobj_rx->validation_func = validate_fill_empty;
diff --git a/tools/testing/selftests/bpf/testing_helpers.c b/tools/testing/selftests/bpf/testing_helpers.c
index 16eb37e5bad6..66af0d13751a 100644
--- a/tools/testing/selftests/bpf/testing_helpers.c
+++ b/tools/testing/selftests/bpf/testing_helpers.c
@@ -212,6 +212,7 @@ int parse_test_list_file(const char *path,
break;
}
+ free(buf);
fclose(f);
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH bpf v2 05/15] selftests/bpf: Fix memory leaks in tests
2026-02-18 0:30 ` [PATCH bpf v2 05/15] selftests/bpf: Fix memory leaks in tests Ihor Solodrai
@ 2026-02-19 23:58 ` Eduard Zingerman
0 siblings, 0 replies; 28+ messages in thread
From: Eduard Zingerman @ 2026-02-19 23:58 UTC (permalink / raw)
To: Ihor Solodrai, Alexei Starovoitov, Andrii Nakryiko,
Daniel Borkmann, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
On Tue, 2026-02-17 at 16:30 -0800, Ihor Solodrai wrote:
> Fix trivial memory leaks detected by userspace ASAN:
> - htab_update: free value buffer in test_reenter_update cleanup
> - test_xsk: inline pkt_stream_replace() in testapp_stats_rx_full()
> and testapp_stats_fill_empty()
> - testing_helpers: free buffer allocated by getline() in
> parse_test_list_file
>
> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
> ---
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
[...]
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH bpf v2 06/15] selftests/bpf: Fix cleanup in check_fd_array_cnt__fd_array_too_big()
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
` (4 preceding siblings ...)
2026-02-18 0:30 ` [PATCH bpf v2 05/15] selftests/bpf: Fix memory leaks in tests Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 07/15] veristat: Fix a memory leak for preset ENUMERATOR Ihor Solodrai
` (8 subsequent siblings)
14 siblings, 0 replies; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
The Close() macro uses the passed in expression three times, which
leads to repeated execution in case it has side effects. That is,
Close(i--) would decrement i three times.
ASAN caught a stack-buffer-undeflow error at a point where this was
overlooked. Fix it.
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
tools/testing/selftests/bpf/prog_tests/fd_array.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/fd_array.c b/tools/testing/selftests/bpf/prog_tests/fd_array.c
index c534b4d5f9da..3078d8264deb 100644
--- a/tools/testing/selftests/bpf/prog_tests/fd_array.c
+++ b/tools/testing/selftests/bpf/prog_tests/fd_array.c
@@ -412,8 +412,8 @@ static void check_fd_array_cnt__fd_array_too_big(void)
ASSERT_EQ(prog_fd, -E2BIG, "prog should have been rejected with -E2BIG");
cleanup_fds:
- while (i > 0)
- Close(extra_fds[--i]);
+ while (i-- > 0)
+ Close(extra_fds[i]);
}
void test_fd_array_cnt(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH bpf v2 07/15] veristat: Fix a memory leak for preset ENUMERATOR
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
` (5 preceding siblings ...)
2026-02-18 0:30 ` [PATCH bpf v2 06/15] selftests/bpf: Fix cleanup in check_fd_array_cnt__fd_array_too_big() Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 08/15] selftests/bpf: Fix use-after-free in xdp_metadata test Ihor Solodrai
` (7 subsequent siblings)
14 siblings, 0 replies; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
ASAN detected a memory leak in veristat. The cleanup code handling
ENUMERATOR value missed freeing strdup-ed svalue. Fix it.
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
tools/testing/selftests/bpf/veristat.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/testing/selftests/bpf/veristat.c b/tools/testing/selftests/bpf/veristat.c
index 1be1e353d40a..75f85e0362f5 100644
--- a/tools/testing/selftests/bpf/veristat.c
+++ b/tools/testing/selftests/bpf/veristat.c
@@ -3378,6 +3378,8 @@ int main(int argc, char **argv)
}
}
free(env.presets[i].atoms);
+ if (env.presets[i].value.type == ENUMERATOR)
+ free(env.presets[i].value.svalue);
}
free(env.presets);
return -err;
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH bpf v2 08/15] selftests/bpf: Fix use-after-free in xdp_metadata test
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
` (6 preceding siblings ...)
2026-02-18 0:30 ` [PATCH bpf v2 07/15] veristat: Fix a memory leak for preset ENUMERATOR Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 09/15] selftests/bpf: Fix double thread join in uprobe_multi_test Ihor Solodrai
` (6 subsequent siblings)
14 siblings, 0 replies; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
ASAN reported a use-after-free in close_xsk().
The xsk->socket internally references xsk->umem via socket->ctx->umem,
so the socket must be deleted before the umem. Fix the order of
operations in close_xsk().
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
tools/testing/selftests/bpf/prog_tests/xdp_metadata.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
index 19f92affc2da..5c31054ad4a4 100644
--- a/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
+++ b/tools/testing/selftests/bpf/prog_tests/xdp_metadata.c
@@ -126,10 +126,10 @@ static int open_xsk(int ifindex, struct xsk *xsk)
static void close_xsk(struct xsk *xsk)
{
- if (xsk->umem)
- xsk_umem__delete(xsk->umem);
if (xsk->socket)
xsk_socket__delete(xsk->socket);
+ if (xsk->umem)
+ xsk_umem__delete(xsk->umem);
munmap(xsk->umem_area, UMEM_SIZE);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH bpf v2 09/15] selftests/bpf: Fix double thread join in uprobe_multi_test
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
` (7 preceding siblings ...)
2026-02-18 0:30 ` [PATCH bpf v2 08/15] selftests/bpf: Fix use-after-free in xdp_metadata test Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 17:54 ` Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 10/15] selftests/bpf: Fix resource leaks caused by missing cleanups Ihor Solodrai
` (5 subsequent siblings)
14 siblings, 1 reply; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
ASAN reported a "joining already joined thread" error. The
release_child() may be called multiple times for the same struct
child.
Fix with a memset(0) call at the end of release_child().
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
index 2ee17ef1dae2..be6ff1d4a75b 100644
--- a/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
+++ b/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
@@ -68,6 +68,7 @@ static void release_child(struct child *child)
close(child->c2p[1]);
if (child->pid > 0)
waitpid(child->pid, &child_status, 0);
+ memset(child, 0, sizeof(*child));
}
static void kick_child(struct child *child)
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH bpf v2 09/15] selftests/bpf: Fix double thread join in uprobe_multi_test
2026-02-18 0:30 ` [PATCH bpf v2 09/15] selftests/bpf: Fix double thread join in uprobe_multi_test Ihor Solodrai
@ 2026-02-18 17:54 ` Ihor Solodrai
2026-02-18 18:47 ` Mykyta Yatsenko
2026-02-22 22:18 ` [PATCH bpf v2 09/15] selftests/bpf: Fix double thread join in uprobe_multi_testg Jiri Olsa
0 siblings, 2 replies; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 17:54 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko
Cc: Amery Hung, bpf, linux-kernel, kernel-team, Alexis Lothoré
On 2/17/26 4:30 PM, Ihor Solodrai wrote:
> ASAN reported a "joining already joined thread" error. The
> release_child() may be called multiple times for the same struct
> child.
>
> Fix with a memset(0) call at the end of release_child().
>
> Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
> Acked-by: Jiri Olsa <jolsa@kernel.org>
> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
> ---
> tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
> index 2ee17ef1dae2..be6ff1d4a75b 100644
> --- a/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
> +++ b/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
> @@ -68,6 +68,7 @@ static void release_child(struct child *child)
> close(child->c2p[1]);
> if (child->pid > 0)
> waitpid(child->pid, &child_status, 0);
> + memset(child, 0, sizeof(*child));
The CI is failing because of this change.
Apparently, there are asserts on child object after it's released in
kick_child(), so we can't just memset it (without changing the test
logic). The previous version of the fix [1], resetting only
child->thread, is more appropriate I think.
I missed this because uprobe_multi is in DENYLIST.asan
I'll wait a bit in case there is more feedback and send a v3.
[1] https://lore.kernel.org/bpf/20260212011356.3266753-10-ihor.solodrai@linux.dev/
> }
>
> static void kick_child(struct child *child)
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf v2 09/15] selftests/bpf: Fix double thread join in uprobe_multi_test
2026-02-18 17:54 ` Ihor Solodrai
@ 2026-02-18 18:47 ` Mykyta Yatsenko
2026-02-22 22:18 ` [PATCH bpf v2 09/15] selftests/bpf: Fix double thread join in uprobe_multi_testg Jiri Olsa
1 sibling, 0 replies; 28+ messages in thread
From: Mykyta Yatsenko @ 2026-02-18 18:47 UTC (permalink / raw)
To: Ihor Solodrai, Alexei Starovoitov, Andrii Nakryiko,
Daniel Borkmann, Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko
Cc: Amery Hung, bpf, linux-kernel, kernel-team, Alexis Lothoré
On 2/18/26 17:54, Ihor Solodrai wrote:
> On 2/17/26 4:30 PM, Ihor Solodrai wrote:
>> ASAN reported a "joining already joined thread" error. The
>> release_child() may be called multiple times for the same struct
>> child.
>>
>> Fix with a memset(0) call at the end of release_child().
>>
>> Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
>> Acked-by: Jiri Olsa <jolsa@kernel.org>
>> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
>> ---
>> tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
>> index 2ee17ef1dae2..be6ff1d4a75b 100644
>> --- a/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
>> +++ b/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
>> @@ -68,6 +68,7 @@ static void release_child(struct child *child)
>> close(child->c2p[1]);
>> if (child->pid > 0)
>> waitpid(child->pid, &child_status, 0);
>> + memset(child, 0, sizeof(*child));
> The CI is failing because of this change.
>
> Apparently, there are asserts on child object after it's released in
> kick_child(), so we can't just memset it (without changing the test
> logic). The previous version of the fix [1], resetting only
> child->thread, is more appropriate I think.
>
> I missed this because uprobe_multi is in DENYLIST.asan
>
> I'll wait a bit in case there is more feedback and send a v3.
I think it's more logical to memset it before the test run,
not after (in release_child()).
>
> [1] https://lore.kernel.org/bpf/20260212011356.3266753-10-ihor.solodrai@linux.dev/
>
>> }
>>
>> static void kick_child(struct child *child)
>
>
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf v2 09/15] selftests/bpf: Fix double thread join in uprobe_multi_testg
2026-02-18 17:54 ` Ihor Solodrai
2026-02-18 18:47 ` Mykyta Yatsenko
@ 2026-02-22 22:18 ` Jiri Olsa
1 sibling, 0 replies; 28+ messages in thread
From: Jiri Olsa @ 2026-02-22 22:18 UTC (permalink / raw)
To: Ihor Solodrai
Cc: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Amery Hung, bpf,
linux-kernel, kernel-team, Alexis Lothoré
On Wed, Feb 18, 2026 at 09:54:41AM -0800, Ihor Solodrai wrote:
> On 2/17/26 4:30 PM, Ihor Solodrai wrote:
> > ASAN reported a "joining already joined thread" error. The
> > release_child() may be called multiple times for the same struct
> > child.
> >
> > Fix with a memset(0) call at the end of release_child().
> >
> > Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
> > Acked-by: Jiri Olsa <jolsa@kernel.org>
> > Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
> > ---
> > tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
> > index 2ee17ef1dae2..be6ff1d4a75b 100644
> > --- a/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
> > +++ b/tools/testing/selftests/bpf/prog_tests/uprobe_multi_test.c
> > @@ -68,6 +68,7 @@ static void release_child(struct child *child)
> > close(child->c2p[1]);
> > if (child->pid > 0)
> > waitpid(child->pid, &child_status, 0);
> > + memset(child, 0, sizeof(*child));
>
> The CI is failing because of this change.
it's on that child->pid,child->tid check in uprobe_multi_test_run?
>
> Apparently, there are asserts on child object after it's released in
> kick_child(), so we can't just memset it (without changing the test
> logic). The previous version of the fix [1], resetting only
> child->thread, is more appropriate I think.
>
> I missed this because uprobe_multi is in DENYLIST.asan
>
> I'll wait a bit in case there is more feedback and send a v3.
I think we should somehow separate the thread logic from the child to
make the test more clear.. I'll take a look
for now zero-ing the thread, so there's no double join makes sense to me
thanks,
jirka
>
> [1] https://lore.kernel.org/bpf/20260212011356.3266753-10-ihor.solodrai@linux.dev/
>
> > }
> >
> > static void kick_child(struct child *child)
>
>
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH bpf v2 10/15] selftests/bpf: Fix resource leaks caused by missing cleanups
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
` (8 preceding siblings ...)
2026-02-18 0:30 ` [PATCH bpf v2 09/15] selftests/bpf: Fix double thread join in uprobe_multi_test Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 11/15] selftests/bpf: Free bpf_object in test_sysctl Ihor Solodrai
` (4 subsequent siblings)
14 siblings, 0 replies; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
ASAN reported a number of resource leaks:
- Add missing *__destroy(skel) calls
- Replace bpf_link__detach() with bpf_link__destroy() where appropriate
- cgrp_local_storage: Add bpf_link__destroy() when bpf_iter_create fails
- dynptr: Add missing bpf_object__close()
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
.../bpf/prog_tests/cgrp_local_storage.c | 4 ++-
.../testing/selftests/bpf/prog_tests/dynptr.c | 5 +++-
.../selftests/bpf/prog_tests/sockmap_basic.c | 28 +++++++++----------
.../selftests/bpf/prog_tests/sockmap_listen.c | 2 +-
.../bpf/prog_tests/struct_ops_private_stack.c | 4 +--
.../selftests/bpf/prog_tests/tc_opts.c | 6 ++--
.../selftests/bpf/prog_tests/test_tc_tunnel.c | 5 +++-
7 files changed, 29 insertions(+), 25 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/cgrp_local_storage.c b/tools/testing/selftests/bpf/prog_tests/cgrp_local_storage.c
index 9015e2c2ab12..478a77cb67e6 100644
--- a/tools/testing/selftests/bpf/prog_tests/cgrp_local_storage.c
+++ b/tools/testing/selftests/bpf/prog_tests/cgrp_local_storage.c
@@ -202,7 +202,7 @@ static void test_cgroup_iter_sleepable(int cgroup_fd, __u64 cgroup_id)
iter_fd = bpf_iter_create(bpf_link__fd(link));
if (!ASSERT_GE(iter_fd, 0, "iter_create"))
- goto out;
+ goto out_link;
/* trigger the program run */
(void)read(iter_fd, buf, sizeof(buf));
@@ -210,6 +210,8 @@ static void test_cgroup_iter_sleepable(int cgroup_fd, __u64 cgroup_id)
ASSERT_EQ(skel->bss->cgroup_id, cgroup_id, "cgroup_id");
close(iter_fd);
+out_link:
+ bpf_link__destroy(link);
out:
cgrp_ls_sleepable__destroy(skel);
}
diff --git a/tools/testing/selftests/bpf/prog_tests/dynptr.c b/tools/testing/selftests/bpf/prog_tests/dynptr.c
index b9f86cb91e81..5fda11590708 100644
--- a/tools/testing/selftests/bpf/prog_tests/dynptr.c
+++ b/tools/testing/selftests/bpf/prog_tests/dynptr.c
@@ -137,11 +137,14 @@ static void verify_success(const char *prog_name, enum test_setup_type setup_typ
);
link = bpf_program__attach(prog);
- if (!ASSERT_OK_PTR(link, "bpf_program__attach"))
+ if (!ASSERT_OK_PTR(link, "bpf_program__attach")) {
+ bpf_object__close(obj);
goto cleanup;
+ }
err = bpf_prog_test_run_opts(aux_prog_fd, &topts);
bpf_link__destroy(link);
+ bpf_object__close(obj);
if (!ASSERT_OK(err, "test_run"))
goto cleanup;
diff --git a/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c b/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c
index 256707e7d20d..dd3c757859f6 100644
--- a/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c
+++ b/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c
@@ -204,7 +204,7 @@ static void test_skmsg_helpers_with_link(enum bpf_map_type map_type)
/* Fail since bpf_link for the same prog type has been created. */
link2 = bpf_program__attach_sockmap(prog_clone, map);
if (!ASSERT_ERR_PTR(link2, "bpf_program__attach_sockmap")) {
- bpf_link__detach(link2);
+ bpf_link__destroy(link2);
goto out;
}
@@ -230,7 +230,7 @@ static void test_skmsg_helpers_with_link(enum bpf_map_type map_type)
if (!ASSERT_OK(err, "bpf_link_update"))
goto out;
out:
- bpf_link__detach(link);
+ bpf_link__destroy(link);
test_skmsg_load_helpers__destroy(skel);
}
@@ -417,7 +417,7 @@ static void test_sockmap_skb_verdict_attach_with_link(void)
if (!ASSERT_OK_PTR(link, "bpf_program__attach_sockmap"))
goto out;
- bpf_link__detach(link);
+ bpf_link__destroy(link);
err = bpf_prog_attach(bpf_program__fd(prog), map, BPF_SK_SKB_STREAM_VERDICT, 0);
if (!ASSERT_OK(err, "bpf_prog_attach"))
@@ -426,7 +426,7 @@ static void test_sockmap_skb_verdict_attach_with_link(void)
/* Fail since attaching with the same prog/map has been done. */
link = bpf_program__attach_sockmap(prog, map);
if (!ASSERT_ERR_PTR(link, "bpf_program__attach_sockmap"))
- bpf_link__detach(link);
+ bpf_link__destroy(link);
err = bpf_prog_detach2(bpf_program__fd(prog), map, BPF_SK_SKB_STREAM_VERDICT);
if (!ASSERT_OK(err, "bpf_prog_detach2"))
@@ -747,13 +747,13 @@ static void test_sockmap_skb_verdict_peek_with_link(void)
test_sockmap_skb_verdict_peek_helper(map);
ASSERT_EQ(pass->bss->clone_called, 1, "clone_called");
out:
- bpf_link__detach(link);
+ bpf_link__destroy(link);
test_sockmap_pass_prog__destroy(pass);
}
static void test_sockmap_unconnected_unix(void)
{
- int err, map, stream = 0, dgram = 0, zero = 0;
+ int err, map, stream = -1, dgram = -1, zero = 0;
struct test_sockmap_pass_prog *skel;
skel = test_sockmap_pass_prog__open_and_load();
@@ -764,22 +764,22 @@ static void test_sockmap_unconnected_unix(void)
stream = xsocket(AF_UNIX, SOCK_STREAM, 0);
if (stream < 0)
- return;
+ goto out;
dgram = xsocket(AF_UNIX, SOCK_DGRAM, 0);
- if (dgram < 0) {
- close(stream);
- return;
- }
+ if (dgram < 0)
+ goto out;
err = bpf_map_update_elem(map, &zero, &stream, BPF_ANY);
- ASSERT_ERR(err, "bpf_map_update_elem(stream)");
+ if (!ASSERT_ERR(err, "bpf_map_update_elem(stream)"))
+ goto out;
err = bpf_map_update_elem(map, &zero, &dgram, BPF_ANY);
ASSERT_OK(err, "bpf_map_update_elem(dgram)");
-
+out:
close(stream);
close(dgram);
+ test_sockmap_pass_prog__destroy(skel);
}
static void test_sockmap_many_socket(void)
@@ -1027,7 +1027,7 @@ static void test_sockmap_skb_verdict_vsock_poll(void)
if (xrecv_nonblock(conn, &buf, 1, 0) != 1)
FAIL("xrecv_nonblock");
detach:
- bpf_link__detach(link);
+ bpf_link__destroy(link);
close:
xclose(conn);
xclose(peer);
diff --git a/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c b/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c
index f1bdccc7e4e7..cc0c68bab907 100644
--- a/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c
+++ b/tools/testing/selftests/bpf/prog_tests/sockmap_listen.c
@@ -899,7 +899,7 @@ static void test_msg_redir_to_listening_with_link(struct test_sockmap_listen *sk
redir_to_listening(family, sotype, sock_map, verdict_map, REDIR_EGRESS);
- bpf_link__detach(link);
+ bpf_link__destroy(link);
}
static void redir_partial(int family, int sotype, int sock_map, int parser_map)
diff --git a/tools/testing/selftests/bpf/prog_tests/struct_ops_private_stack.c b/tools/testing/selftests/bpf/prog_tests/struct_ops_private_stack.c
index 4006879ca3fe..d42123a0fb16 100644
--- a/tools/testing/selftests/bpf/prog_tests/struct_ops_private_stack.c
+++ b/tools/testing/selftests/bpf/prog_tests/struct_ops_private_stack.c
@@ -54,9 +54,7 @@ static void test_private_stack_fail(void)
}
err = struct_ops_private_stack_fail__load(skel);
- if (!ASSERT_ERR(err, "struct_ops_private_stack_fail__load"))
- goto cleanup;
- return;
+ ASSERT_ERR(err, "struct_ops_private_stack_fail__load");
cleanup:
struct_ops_private_stack_fail__destroy(skel);
diff --git a/tools/testing/selftests/bpf/prog_tests/tc_opts.c b/tools/testing/selftests/bpf/prog_tests/tc_opts.c
index dd7a138d8c3d..2955750ddada 100644
--- a/tools/testing/selftests/bpf/prog_tests/tc_opts.c
+++ b/tools/testing/selftests/bpf/prog_tests/tc_opts.c
@@ -1360,10 +1360,8 @@ static void test_tc_opts_dev_cleanup_target(int target)
assert_mprog_count_ifindex(ifindex, target, 4);
- ASSERT_OK(system("ip link del dev tcx_opts1"), "del veth");
- ASSERT_EQ(if_nametoindex("tcx_opts1"), 0, "dev1_removed");
- ASSERT_EQ(if_nametoindex("tcx_opts2"), 0, "dev2_removed");
- return;
+ goto cleanup;
+
cleanup3:
err = bpf_prog_detach_opts(fd3, loopback, target, &optd);
ASSERT_OK(err, "prog_detach");
diff --git a/tools/testing/selftests/bpf/prog_tests/test_tc_tunnel.c b/tools/testing/selftests/bpf/prog_tests/test_tc_tunnel.c
index 0fe0a8f62486..7fc4d7dd70ef 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_tc_tunnel.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_tc_tunnel.c
@@ -699,7 +699,7 @@ void test_tc_tunnel(void)
return;
if (!ASSERT_OK(setup(), "global setup"))
- return;
+ goto out;
for (i = 0; i < ARRAY_SIZE(subtests_cfg); i++) {
cfg = &subtests_cfg[i];
@@ -711,4 +711,7 @@ void test_tc_tunnel(void)
subtest_cleanup(cfg);
}
cleanup();
+
+out:
+ test_tc_tunnel__destroy(skel);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH bpf v2 11/15] selftests/bpf: Free bpf_object in test_sysctl
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
` (9 preceding siblings ...)
2026-02-18 0:30 ` [PATCH bpf v2 10/15] selftests/bpf: Fix resource leaks caused by missing cleanups Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-20 0:08 ` Eduard Zingerman
2026-02-18 0:30 ` [PATCH bpf v2 12/15] selftests/bpf: Fix array bounds warning in jit_disasm_helpers Ihor Solodrai
` (3 subsequent siblings)
14 siblings, 1 reply; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
ASAN reported a resource leak due to the bpf_object not being tracked
in test_sysctl. Add obj field to struct sysctl_test to properly clean
up bpf_object if a program was loaded from a file.
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
.../testing/selftests/bpf/prog_tests/test_sysctl.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/test_sysctl.c b/tools/testing/selftests/bpf/prog_tests/test_sysctl.c
index 273dd41ca09e..4349b846f1b3 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_sysctl.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_sysctl.c
@@ -27,6 +27,7 @@ struct sysctl_test {
OP_EPERM,
SUCCESS,
} result;
+ struct bpf_object *obj;
};
static struct sysctl_test tests[] = {
@@ -1471,14 +1472,16 @@ static int load_sysctl_prog_file(struct sysctl_test *test)
return -1;
}
+ test->obj = obj;
return prog_fd;
}
static int load_sysctl_prog(struct sysctl_test *test, const char *sysctl_path)
{
- return test->prog_file
- ? load_sysctl_prog_file(test)
- : load_sysctl_prog_insns(test, sysctl_path);
+ if (test->prog_file)
+ return load_sysctl_prog_file(test);
+ test->obj = NULL;
+ return load_sysctl_prog_insns(test, sysctl_path);
}
static int access_sysctl(const char *sysctl_path,
@@ -1573,7 +1576,10 @@ static int run_test_case(int cgfd, struct sysctl_test *test)
/* Detaching w/o checking return code: best effort attempt. */
if (progfd != -1)
bpf_prog_detach(cgfd, atype);
- close(progfd);
+ if (test->obj)
+ bpf_object__close(test->obj);
+ else if (progfd != -1)
+ close(progfd);
printf("[%s]\n", err ? "FAIL" : "PASS");
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH bpf v2 11/15] selftests/bpf: Free bpf_object in test_sysctl
2026-02-18 0:30 ` [PATCH bpf v2 11/15] selftests/bpf: Free bpf_object in test_sysctl Ihor Solodrai
@ 2026-02-20 0:08 ` Eduard Zingerman
0 siblings, 0 replies; 28+ messages in thread
From: Eduard Zingerman @ 2026-02-20 0:08 UTC (permalink / raw)
To: Ihor Solodrai, Alexei Starovoitov, Andrii Nakryiko,
Daniel Borkmann, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
On Tue, 2026-02-17 at 16:30 -0800, Ihor Solodrai wrote:
> ASAN reported a resource leak due to the bpf_object not being tracked
> in test_sysctl. Add obj field to struct sysctl_test to properly clean
> up bpf_object if a program was loaded from a file.
>
> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
> ---
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
> @@ -1471,14 +1472,16 @@ static int load_sysctl_prog_file(struct sysctl_test *test)
> return -1;
> }
>
> + test->obj = obj;
> return prog_fd;
> }
>
> static int load_sysctl_prog(struct sysctl_test *test, const char *sysctl_path)
> {
> - return test->prog_file
> - ? load_sysctl_prog_file(test)
> - : load_sysctl_prog_insns(test, sysctl_path);
> + if (test->prog_file)
> + return load_sysctl_prog_file(test);
> + test->obj = NULL;
Nit: is this necessary? The way `tests` is defined ->obj will be NULL anyway.
Looks a bit asymmetrical.
> + return load_sysctl_prog_insns(test, sysctl_path);
> }
>
> static int access_sysctl(const char *sysctl_path,
> @@ -1573,7 +1576,10 @@ static int run_test_case(int cgfd, struct sysctl_test *test)
> /* Detaching w/o checking return code: best effort attempt. */
> if (progfd != -1)
> bpf_prog_detach(cgfd, atype);
> - close(progfd);
> + if (test->obj)
> + bpf_object__close(test->obj);
> + else if (progfd != -1)
> + close(progfd);
Nit: close(-1) works fine, as well as bpf_object__close(NULL),
so there is no need for 'if' statements here.
> printf("[%s]\n", err ? "FAIL" : "PASS");
> return err;
> }
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH bpf v2 12/15] selftests/bpf: Fix array bounds warning in jit_disasm_helpers
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
` (10 preceding siblings ...)
2026-02-18 0:30 ` [PATCH bpf v2 11/15] selftests/bpf: Free bpf_object in test_sysctl Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 13/15] selftests/bpf: Fix out-of-bounds array access bugs reported by ASAN Ihor Solodrai
` (2 subsequent siblings)
14 siblings, 0 replies; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
Compiler cannot infer upper bound for labels.cnt and warns about
potential buffer overflow in snprintf. Add an explicit bounds
check (... && i < MAX_LOCAL_LABELS) in the loop condition to fix the
warning.
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
.../testing/selftests/bpf/jit_disasm_helpers.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/tools/testing/selftests/bpf/jit_disasm_helpers.c b/tools/testing/selftests/bpf/jit_disasm_helpers.c
index febd6b12e372..364c557c5115 100644
--- a/tools/testing/selftests/bpf/jit_disasm_helpers.c
+++ b/tools/testing/selftests/bpf/jit_disasm_helpers.c
@@ -122,15 +122,15 @@ static int disasm_one_func(FILE *text_out, uint8_t *image, __u32 len)
pc += cnt;
}
qsort(labels.pcs, labels.cnt, sizeof(*labels.pcs), cmp_u32);
- for (i = 0; i < labels.cnt; ++i)
- /* gcc is unable to infer upper bound for labels.cnt and assumes
- * it to be U32_MAX. U32_MAX takes 10 decimal digits.
- * snprintf below prints into labels.names[*],
- * which has space only for two digits and a letter.
- * To avoid truncation warning use (i % MAX_LOCAL_LABELS),
- * which informs gcc about printed value upper bound.
- */
- snprintf(labels.names[i], sizeof(labels.names[i]), "L%d", i % MAX_LOCAL_LABELS);
+ /* gcc is unable to infer upper bound for labels.cnt and
+ * assumes it to be U32_MAX. U32_MAX takes 10 decimal digits.
+ * snprintf below prints into labels.names[*], which has space
+ * only for two digits and a letter. To avoid truncation
+ * warning use (i < MAX_LOCAL_LABELS), which informs gcc about
+ * printed value upper bound.
+ */
+ for (i = 0; i < labels.cnt && i < MAX_LOCAL_LABELS; ++i)
+ snprintf(labels.names[i], sizeof(labels.names[i]), "L%d", i);
/* now print with labels */
labels.print_phase = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH bpf v2 13/15] selftests/bpf: Fix out-of-bounds array access bugs reported by ASAN
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
` (11 preceding siblings ...)
2026-02-18 0:30 ` [PATCH bpf v2 12/15] selftests/bpf: Fix array bounds warning in jit_disasm_helpers Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 14/15] selftests/bpf: Check BPFTOOL env var in detect_bpftool_path() Ihor Solodrai
2026-02-18 0:30 ` [PATCH bpf v2 15/15] selftests/bpf: Don't override SIGSEGV handler with ASAN Ihor Solodrai
14 siblings, 0 replies; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
- kmem_cache_iter: remove unnecessary debug output
- lwt_seg6local: change the type of foobar to char[]
- the sizeof(foobar) returned the pointer size and not a string
length as intended
- verifier_log: increase prog_name buffer size in verif_log_subtest()
- compiler has a conservative estimate of fixed_log_sz value, making
ASAN complain on snprint() call
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c | 7 ++-----
tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c | 2 +-
tools/testing/selftests/bpf/prog_tests/verifier_log.c | 2 +-
3 files changed, 4 insertions(+), 7 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c b/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
index 6e35e13c2022..399fe9103f83 100644
--- a/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
+++ b/tools/testing/selftests/bpf/prog_tests/kmem_cache_iter.c
@@ -104,11 +104,8 @@ void test_kmem_cache_iter(void)
if (!ASSERT_GE(iter_fd, 0, "iter_create"))
goto destroy;
- memset(buf, 0, sizeof(buf));
- while (read(iter_fd, buf, sizeof(buf)) > 0) {
- /* Read out all contents */
- printf("%s", buf);
- }
+ while (read(iter_fd, buf, sizeof(buf)) > 0)
+ ; /* Read out all contents */
/* Next reads should return 0 */
ASSERT_EQ(read(iter_fd, buf, sizeof(buf)), 0, "read");
diff --git a/tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c b/tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c
index 3bc730b7c7fa..1b25d5c5f8fb 100644
--- a/tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c
+++ b/tools/testing/selftests/bpf/prog_tests/lwt_seg6local.c
@@ -117,7 +117,7 @@ void test_lwt_seg6local(void)
const char *ns1 = NETNS_BASE "1";
const char *ns6 = NETNS_BASE "6";
struct nstoken *nstoken = NULL;
- const char *foobar = "foobar";
+ const char foobar[] = "foobar";
ssize_t bytes;
int sfd, cfd;
char buf[7];
diff --git a/tools/testing/selftests/bpf/prog_tests/verifier_log.c b/tools/testing/selftests/bpf/prog_tests/verifier_log.c
index 8337c6bc5b95..aaa2854974c0 100644
--- a/tools/testing/selftests/bpf/prog_tests/verifier_log.c
+++ b/tools/testing/selftests/bpf/prog_tests/verifier_log.c
@@ -47,7 +47,7 @@ static int load_prog(struct bpf_prog_load_opts *opts, bool expect_load_error)
static void verif_log_subtest(const char *name, bool expect_load_error, int log_level)
{
LIBBPF_OPTS(bpf_prog_load_opts, opts);
- char *exp_log, prog_name[16], op_name[32];
+ char *exp_log, prog_name[24], op_name[32];
struct test_log_buf *skel;
struct bpf_program *prog;
size_t fixed_log_sz;
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH bpf v2 14/15] selftests/bpf: Check BPFTOOL env var in detect_bpftool_path()
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
` (12 preceding siblings ...)
2026-02-18 0:30 ` [PATCH bpf v2 13/15] selftests/bpf: Fix out-of-bounds array access bugs reported by ASAN Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 16:44 ` Mykyta Yatsenko
2026-02-18 17:38 ` Alexei Starovoitov
2026-02-18 0:30 ` [PATCH bpf v2 15/15] selftests/bpf: Don't override SIGSEGV handler with ASAN Ihor Solodrai
14 siblings, 2 replies; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
The bpftool_maps_access and bpftool_metadata tests may fail on BPF CI
with "command not found", depending on a workflow.
This happens because detect_bpftool_path() only checks two hardcoded
relative paths:
- ./tools/sbin/bpftool
- ../tools/sbin/bpftool
Add support for a BPFTOOL environment variable that allows specifying
the exact path to the bpftool binary.
Also replace strncpy() with snprintf() for proper null-termination.
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
tools/testing/selftests/bpf/bpftool_helpers.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/bpf/bpftool_helpers.c b/tools/testing/selftests/bpf/bpftool_helpers.c
index a5824945a4a5..d810e73da6c8 100644
--- a/tools/testing/selftests/bpf/bpftool_helpers.c
+++ b/tools/testing/selftests/bpf/bpftool_helpers.c
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
#include "bpftool_helpers.h"
+#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <stdbool.h>
@@ -12,13 +13,24 @@
static int detect_bpftool_path(char *buffer)
{
char tmp[BPFTOOL_PATH_MAX_LEN];
+ const char *env_path;
+
+ /* First, check if BPFTOOL environment variable is set */
+ env_path = getenv("BPFTOOL");
+ if (env_path && access(env_path, X_OK) == 0) {
+ snprintf(buffer, BPFTOOL_PATH_MAX_LEN, "%s", env_path);
+ return 0;
+ } else if (env_path) {
+ fprintf(stderr, "bpftool '%s' doesn't exist or is not executable\n", env_path);
+ return 1;
+ }
/* Check default bpftool location (will work if we are running the
* default flavor of test_progs)
*/
snprintf(tmp, BPFTOOL_PATH_MAX_LEN, "./%s", BPFTOOL_DEFAULT_PATH);
if (access(tmp, X_OK) == 0) {
- strncpy(buffer, tmp, BPFTOOL_PATH_MAX_LEN);
+ snprintf(buffer, BPFTOOL_PATH_MAX_LEN, "%s", tmp);
return 0;
}
@@ -27,11 +39,11 @@ static int detect_bpftool_path(char *buffer)
*/
snprintf(tmp, BPFTOOL_PATH_MAX_LEN, "../%s", BPFTOOL_DEFAULT_PATH);
if (access(tmp, X_OK) == 0) {
- strncpy(buffer, tmp, BPFTOOL_PATH_MAX_LEN);
+ snprintf(buffer, BPFTOOL_PATH_MAX_LEN, "%s", tmp);
return 0;
}
- /* Failed to find bpftool binary */
+ fprintf(stderr, "Failed to detect bpftool path, use BPFTOOL env var to override\n");
return 1;
}
@@ -71,4 +83,3 @@ int get_bpftool_command_output(char *args, char *output_buf, size_t output_max_l
{
return run_command(args, output_buf, output_max_len);
}
-
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH bpf v2 14/15] selftests/bpf: Check BPFTOOL env var in detect_bpftool_path()
2026-02-18 0:30 ` [PATCH bpf v2 14/15] selftests/bpf: Check BPFTOOL env var in detect_bpftool_path() Ihor Solodrai
@ 2026-02-18 16:44 ` Mykyta Yatsenko
2026-02-18 17:38 ` Alexei Starovoitov
1 sibling, 0 replies; 28+ messages in thread
From: Mykyta Yatsenko @ 2026-02-18 16:44 UTC (permalink / raw)
To: Ihor Solodrai, Alexei Starovoitov, Andrii Nakryiko,
Daniel Borkmann, Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko,
Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
On 2/18/26 00:30, Ihor Solodrai wrote:
> The bpftool_maps_access and bpftool_metadata tests may fail on BPF CI
> with "command not found", depending on a workflow.
> This happens because detect_bpftool_path() only checks two hardcoded
> relative paths:
> - ./tools/sbin/bpftool
> - ../tools/sbin/bpftool
>
> Add support for a BPFTOOL environment variable that allows specifying
> the exact path to the bpftool binary.
>
> Also replace strncpy() with snprintf() for proper null-termination.
>
> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
> ---
> tools/testing/selftests/bpf/bpftool_helpers.c | 19 +++++++++++++++----
> 1 file changed, 15 insertions(+), 4 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/bpftool_helpers.c b/tools/testing/selftests/bpf/bpftool_helpers.c
> index a5824945a4a5..d810e73da6c8 100644
> --- a/tools/testing/selftests/bpf/bpftool_helpers.c
> +++ b/tools/testing/selftests/bpf/bpftool_helpers.c
> @@ -1,5 +1,6 @@
> // SPDX-License-Identifier: GPL-2.0-only
> #include "bpftool_helpers.h"
> +#include <stdio.h>
> #include <unistd.h>
> #include <string.h>
> #include <stdbool.h>
> @@ -12,13 +13,24 @@
> static int detect_bpftool_path(char *buffer)
> {
> char tmp[BPFTOOL_PATH_MAX_LEN];
> + const char *env_path;
> +
> + /* First, check if BPFTOOL environment variable is set */
> + env_path = getenv("BPFTOOL");
> + if (env_path && access(env_path, X_OK) == 0) {
> + snprintf(buffer, BPFTOOL_PATH_MAX_LEN, "%s", env_path);
> + return 0;
> + } else if (env_path) {
> + fprintf(stderr, "bpftool '%s' doesn't exist or is not executable\n", env_path);
> + return 1;
> + }
>
> /* Check default bpftool location (will work if we are running the
> * default flavor of test_progs)
> */
> snprintf(tmp, BPFTOOL_PATH_MAX_LEN, "./%s", BPFTOOL_DEFAULT_PATH);
> if (access(tmp, X_OK) == 0) {
> - strncpy(buffer, tmp, BPFTOOL_PATH_MAX_LEN);
> + snprintf(buffer, BPFTOOL_PATH_MAX_LEN, "%s", tmp);
> return 0;
> }
>
> @@ -27,11 +39,11 @@ static int detect_bpftool_path(char *buffer)
> */
> snprintf(tmp, BPFTOOL_PATH_MAX_LEN, "../%s", BPFTOOL_DEFAULT_PATH);
> if (access(tmp, X_OK) == 0) {
> - strncpy(buffer, tmp, BPFTOOL_PATH_MAX_LEN);
> + snprintf(buffer, BPFTOOL_PATH_MAX_LEN, "%s", tmp);
> return 0;
> }
>
> - /* Failed to find bpftool binary */
> + fprintf(stderr, "Failed to detect bpftool path, use BPFTOOL env var to override\n");
> return 1;
> }
>
> @@ -71,4 +83,3 @@ int get_bpftool_command_output(char *args, char *output_buf, size_t output_max_l
> {
> return run_command(args, output_buf, output_max_len);
> }
> -
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [PATCH bpf v2 14/15] selftests/bpf: Check BPFTOOL env var in detect_bpftool_path()
2026-02-18 0:30 ` [PATCH bpf v2 14/15] selftests/bpf: Check BPFTOOL env var in detect_bpftool_path() Ihor Solodrai
2026-02-18 16:44 ` Mykyta Yatsenko
@ 2026-02-18 17:38 ` Alexei Starovoitov
2026-02-18 18:17 ` Ihor Solodrai
1 sibling, 1 reply; 28+ messages in thread
From: Alexei Starovoitov @ 2026-02-18 17:38 UTC (permalink / raw)
To: Ihor Solodrai
Cc: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré,
Amery Hung, bpf, LKML, Kernel Team
On Tue, Feb 17, 2026 at 4:31 PM Ihor Solodrai <ihor.solodrai@linux.dev> wrote:
>
> The bpftool_maps_access and bpftool_metadata tests may fail on BPF CI
> with "command not found", depending on a workflow.
> This happens because detect_bpftool_path() only checks two hardcoded
> relative paths:
> - ./tools/sbin/bpftool
> - ../tools/sbin/bpftool
>
> Add support for a BPFTOOL environment variable that allows specifying
> the exact path to the bpftool binary.
>
> Also replace strncpy() with snprintf() for proper null-termination.
>
> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
> ---
> tools/testing/selftests/bpf/bpftool_helpers.c | 19 +++++++++++++++----
> 1 file changed, 15 insertions(+), 4 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/bpftool_helpers.c b/tools/testing/selftests/bpf/bpftool_helpers.c
> index a5824945a4a5..d810e73da6c8 100644
> --- a/tools/testing/selftests/bpf/bpftool_helpers.c
> +++ b/tools/testing/selftests/bpf/bpftool_helpers.c
> @@ -1,5 +1,6 @@
> // SPDX-License-Identifier: GPL-2.0-only
> #include "bpftool_helpers.h"
> +#include <stdio.h>
> #include <unistd.h>
> #include <string.h>
> #include <stdbool.h>
> @@ -12,13 +13,24 @@
> static int detect_bpftool_path(char *buffer)
> {
> char tmp[BPFTOOL_PATH_MAX_LEN];
> + const char *env_path;
> +
> + /* First, check if BPFTOOL environment variable is set */
> + env_path = getenv("BPFTOOL");
> + if (env_path && access(env_path, X_OK) == 0) {
> + snprintf(buffer, BPFTOOL_PATH_MAX_LEN, "%s", env_path);
> + return 0;
> + } else if (env_path) {
> + fprintf(stderr, "bpftool '%s' doesn't exist or is not executable\n", env_path);
> + return 1;
> + }
>
> /* Check default bpftool location (will work if we are running the
> * default flavor of test_progs)
> */
> snprintf(tmp, BPFTOOL_PATH_MAX_LEN, "./%s", BPFTOOL_DEFAULT_PATH);
> if (access(tmp, X_OK) == 0) {
> - strncpy(buffer, tmp, BPFTOOL_PATH_MAX_LEN);
> + snprintf(buffer, BPFTOOL_PATH_MAX_LEN, "%s", tmp);
I guess it's ok for user space, but
git log --oneline|grep "snprintf with strscpy"
ad789a85b163 mm/cma: replace snprintf with strscpy in cma_new_area
674fb053e95d sparc: vio: Replace snprintf with strscpy in vio_create_one
2dfc417414c6 genirq/proc: Replace snprintf with strscpy in register_handler_proc
f46ebb910989 block: Replace snprintf with strscpy in check_partition
b66215e7b780 media: verisilicon: replace snprintf with strscpy+strlcat
a86028f8e3ee staging: most: sound: replace snprintf with strscpy
and many others...
So.. should we introduce strscpy() in selftests/bpf ?
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [PATCH bpf v2 14/15] selftests/bpf: Check BPFTOOL env var in detect_bpftool_path()
2026-02-18 17:38 ` Alexei Starovoitov
@ 2026-02-18 18:17 ` Ihor Solodrai
2026-02-19 1:12 ` Ihor Solodrai
0 siblings, 1 reply; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 18:17 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré,
Amery Hung, bpf, LKML, Kernel Team
On 2/18/26 9:38 AM, Alexei Starovoitov wrote:
> On Tue, Feb 17, 2026 at 4:31 PM Ihor Solodrai <ihor.solodrai@linux.dev> wrote:
>>
>> The bpftool_maps_access and bpftool_metadata tests may fail on BPF CI
>> with "command not found", depending on a workflow.
>> This happens because detect_bpftool_path() only checks two hardcoded
>> relative paths:
>> - ./tools/sbin/bpftool
>> - ../tools/sbin/bpftool
>>
>> Add support for a BPFTOOL environment variable that allows specifying
>> the exact path to the bpftool binary.
>>
>> Also replace strncpy() with snprintf() for proper null-termination.
>>
>> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
>> ---
>> tools/testing/selftests/bpf/bpftool_helpers.c | 19 +++++++++++++++----
>> 1 file changed, 15 insertions(+), 4 deletions(-)
>>
>> diff --git a/tools/testing/selftests/bpf/bpftool_helpers.c b/tools/testing/selftests/bpf/bpftool_helpers.c
>> index a5824945a4a5..d810e73da6c8 100644
>> --- a/tools/testing/selftests/bpf/bpftool_helpers.c
>> +++ b/tools/testing/selftests/bpf/bpftool_helpers.c
>> @@ -1,5 +1,6 @@
>> // SPDX-License-Identifier: GPL-2.0-only
>> #include "bpftool_helpers.h"
>> +#include <stdio.h>
>> #include <unistd.h>
>> #include <string.h>
>> #include <stdbool.h>
>> @@ -12,13 +13,24 @@
>> static int detect_bpftool_path(char *buffer)
>> {
>> char tmp[BPFTOOL_PATH_MAX_LEN];
>> + const char *env_path;
>> +
>> + /* First, check if BPFTOOL environment variable is set */
>> + env_path = getenv("BPFTOOL");
>> + if (env_path && access(env_path, X_OK) == 0) {
>> + snprintf(buffer, BPFTOOL_PATH_MAX_LEN, "%s", env_path);
>> + return 0;
>> + } else if (env_path) {
>> + fprintf(stderr, "bpftool '%s' doesn't exist or is not executable\n", env_path);
>> + return 1;
>> + }
>>
>> /* Check default bpftool location (will work if we are running the
>> * default flavor of test_progs)
>> */
>> snprintf(tmp, BPFTOOL_PATH_MAX_LEN, "./%s", BPFTOOL_DEFAULT_PATH);
>> if (access(tmp, X_OK) == 0) {
>> - strncpy(buffer, tmp, BPFTOOL_PATH_MAX_LEN);
>> + snprintf(buffer, BPFTOOL_PATH_MAX_LEN, "%s", tmp);
>
> I guess it's ok for user space, but
>
> git log --oneline|grep "snprintf with strscpy"
> ad789a85b163 mm/cma: replace snprintf with strscpy in cma_new_area
> 674fb053e95d sparc: vio: Replace snprintf with strscpy in vio_create_one
> 2dfc417414c6 genirq/proc: Replace snprintf with strscpy in register_handler_proc
> f46ebb910989 block: Replace snprintf with strscpy in check_partition
> b66215e7b780 media: verisilicon: replace snprintf with strscpy+strlcat
> a86028f8e3ee staging: most: sound: replace snprintf with strscpy
>
> and many others...
> So.. should we introduce strscpy() in selftests/bpf ?
I guess we can, but:
$ grep -r 'snprintf(' --include="*.[ch]" tools/testing/selftests/bpf/ | wc -l
238
The reason to prefer strscpy() is speed, right?
Can we use kernel implementation in userspace directly?
In tools/include I only see this:
#define strscpy strcpy
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [PATCH bpf v2 14/15] selftests/bpf: Check BPFTOOL env var in detect_bpftool_path()
2026-02-18 18:17 ` Ihor Solodrai
@ 2026-02-19 1:12 ` Ihor Solodrai
2026-02-19 1:39 ` Alexei Starovoitov
0 siblings, 1 reply; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-19 1:12 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré,
Amery Hung, bpf, LKML, Kernel Team
On 2/18/26 10:17 AM, Ihor Solodrai wrote:
> On 2/18/26 9:38 AM, Alexei Starovoitov wrote:
>> On Tue, Feb 17, 2026 at 4:31 PM Ihor Solodrai <ihor.solodrai@linux.dev> wrote:
>>>
>>> [...]
>>>
>>> /* Check default bpftool location (will work if we are running the
>>> * default flavor of test_progs)
>>> */
>>> snprintf(tmp, BPFTOOL_PATH_MAX_LEN, "./%s", BPFTOOL_DEFAULT_PATH);
>>> if (access(tmp, X_OK) == 0) {
>>> - strncpy(buffer, tmp, BPFTOOL_PATH_MAX_LEN);
>>> + snprintf(buffer, BPFTOOL_PATH_MAX_LEN, "%s", tmp);
>>
>> I guess it's ok for user space, but
>>
>> git log --oneline|grep "snprintf with strscpy"
>> ad789a85b163 mm/cma: replace snprintf with strscpy in cma_new_area
>> 674fb053e95d sparc: vio: Replace snprintf with strscpy in vio_create_one
>> 2dfc417414c6 genirq/proc: Replace snprintf with strscpy in register_handler_proc
>> f46ebb910989 block: Replace snprintf with strscpy in check_partition
>> b66215e7b780 media: verisilicon: replace snprintf with strscpy+strlcat
>> a86028f8e3ee staging: most: sound: replace snprintf with strscpy
>>
>> and many others...
>> So.. should we introduce strscpy() in selftests/bpf ?
>
> I guess we can, but:
>
> $ grep -r 'snprintf(' --include="*.[ch]" tools/testing/selftests/bpf/ | wc -l
> 238
>
> The reason to prefer strscpy() is speed, right?
> Can we use kernel implementation in userspace directly?
>
> In tools/include I only see this:
>
> #define strscpy strcpy
>
I think we can add a simple implementation to tools/lib/string.c
See a diff below: essentially a copy from arch/s390/boot/string.c [1]
I suppose it's faster than snprintf(). However I am not sure about
going through all 238 usages, as that would touch many files. But at
least we can make actual strscpy available in selftests.
I can add this in v3. Alexei, wdyt?
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/s390/boot/string.c?h=v6.19#n32
diff --git a/tools/include/linux/string.h b/tools/include/linux/string.h
index 51ad3cf4fa82..ca183a0e846a 100644
--- a/tools/include/linux/string.h
+++ b/tools/include/linux/string.h
@@ -3,6 +3,7 @@
#define _TOOLS_LINUX_STRING_H_
#include <linux/types.h> /* for size_t */
+#include <sys/types.h> /* for ssize_t */
#include <string.h>
void *memdup(const void *src, size_t len);
@@ -12,7 +13,7 @@ void argv_free(char **argv);
int strtobool(const char *s, bool *res);
-#define strscpy strcpy
+ssize_t strscpy(char *dest, const char *src, size_t count);
/*
* glibc based builds needs the extern while uClibc doesn't.
diff --git a/tools/lib/string.c b/tools/lib/string.c
index 3126d2cff716..54c9163fa2b0 100644
--- a/tools/lib/string.c
+++ b/tools/lib/string.c
@@ -239,3 +239,17 @@ void *memchr_inv(const void *start, int c, size_t bytes)
return check_bytes8(start, value, bytes % 8);
}
+
+ssize_t strscpy(char *dst, const char *src, size_t count)
+{
+ size_t len;
+
+ if (count == 0)
+ return -E2BIG;
+
+ len = strnlen(src, count - 1);
+ memcpy(dst, src, len);
+ dst[len] = '\0';
+
+ return src[len] ? -E2BIG : len;
+}
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH bpf v2 14/15] selftests/bpf: Check BPFTOOL env var in detect_bpftool_path()
2026-02-19 1:12 ` Ihor Solodrai
@ 2026-02-19 1:39 ` Alexei Starovoitov
0 siblings, 0 replies; 28+ messages in thread
From: Alexei Starovoitov @ 2026-02-19 1:39 UTC (permalink / raw)
To: Ihor Solodrai
Cc: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré,
Amery Hung, bpf, LKML, Kernel Team
On Wed, Feb 18, 2026 at 5:13 PM Ihor Solodrai <ihor.solodrai@linux.dev> wrote:
>
> On 2/18/26 10:17 AM, Ihor Solodrai wrote:
> > On 2/18/26 9:38 AM, Alexei Starovoitov wrote:
> >> On Tue, Feb 17, 2026 at 4:31 PM Ihor Solodrai <ihor.solodrai@linux.dev> wrote:
> >>>
> >>> [...]
> >>>
> >>> /* Check default bpftool location (will work if we are running the
> >>> * default flavor of test_progs)
> >>> */
> >>> snprintf(tmp, BPFTOOL_PATH_MAX_LEN, "./%s", BPFTOOL_DEFAULT_PATH);
> >>> if (access(tmp, X_OK) == 0) {
> >>> - strncpy(buffer, tmp, BPFTOOL_PATH_MAX_LEN);
> >>> + snprintf(buffer, BPFTOOL_PATH_MAX_LEN, "%s", tmp);
> >>
> >> I guess it's ok for user space, but
> >>
> >> git log --oneline|grep "snprintf with strscpy"
> >> ad789a85b163 mm/cma: replace snprintf with strscpy in cma_new_area
> >> 674fb053e95d sparc: vio: Replace snprintf with strscpy in vio_create_one
> >> 2dfc417414c6 genirq/proc: Replace snprintf with strscpy in register_handler_proc
> >> f46ebb910989 block: Replace snprintf with strscpy in check_partition
> >> b66215e7b780 media: verisilicon: replace snprintf with strscpy+strlcat
> >> a86028f8e3ee staging: most: sound: replace snprintf with strscpy
> >>
> >> and many others...
> >> So.. should we introduce strscpy() in selftests/bpf ?
> >
> > I guess we can, but:
> >
> > $ grep -r 'snprintf(' --include="*.[ch]" tools/testing/selftests/bpf/ | wc -l
> > 238
> >
> > The reason to prefer strscpy() is speed, right?
> > Can we use kernel implementation in userspace directly?
> >
> > In tools/include I only see this:
> >
> > #define strscpy strcpy
> >
>
> I think we can add a simple implementation to tools/lib/string.c
> See a diff below: essentially a copy from arch/s390/boot/string.c [1]
>
> I suppose it's faster than snprintf(). However I am not sure about
> going through all 238 usages, as that would touch many files. But at
> least we can make actual strscpy available in selftests.
>
> I can add this in v3. Alexei, wdyt?
>
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/s390/boot/string.c?h=v6.19#n32
>
> diff --git a/tools/include/linux/string.h b/tools/include/linux/string.h
> index 51ad3cf4fa82..ca183a0e846a 100644
> --- a/tools/include/linux/string.h
> +++ b/tools/include/linux/string.h
> @@ -3,6 +3,7 @@
> #define _TOOLS_LINUX_STRING_H_
>
> #include <linux/types.h> /* for size_t */
> +#include <sys/types.h> /* for ssize_t */
> #include <string.h>
>
> void *memdup(const void *src, size_t len);
> @@ -12,7 +13,7 @@ void argv_free(char **argv);
>
> int strtobool(const char *s, bool *res);
>
> -#define strscpy strcpy
> +ssize_t strscpy(char *dest, const char *src, size_t count);
>
> /*
> * glibc based builds needs the extern while uClibc doesn't.
> diff --git a/tools/lib/string.c b/tools/lib/string.c
> index 3126d2cff716..54c9163fa2b0 100644
> --- a/tools/lib/string.c
> +++ b/tools/lib/string.c
> @@ -239,3 +239,17 @@ void *memchr_inv(const void *start, int c, size_t bytes)
>
> return check_bytes8(start, value, bytes % 8);
> }
> +
> +ssize_t strscpy(char *dst, const char *src, size_t count)
> +{
> + size_t len;
> +
> + if (count == 0)
> + return -E2BIG;
> +
> + len = strnlen(src, count - 1);
> + memcpy(dst, src, len);
> + dst[len] = '\0';
> +
> + return src[len] ? -E2BIG : len;
> +}
Hmm. it looks a bit like strlcpy() which is also not recommended.
See Documentation/process/deprecated.rst
that explains the reasons why strscpy() is the only "approved" version.
Also tools/lib/ is too scrutinized.
Let's take sized_strscpy() from lib/string.c
drop all optimizations like word a time, page boundary tricks, etc
and only keep essentially this:
while (count > 1) {
char c;
c = src[res];
dest[res] = c;
if (!c)
return res;
res++;
count--;
}
/* Force NUL-termination. */
dest[res] = '\0';
/* Return E2BIG if the source didn't stop */
return src[res] ? -E2BIG : res;
and add it somewhere in selftests/bpf..
and only use it in these couple cases where we need to fix strncpy.
Further snprintf() cleanup can be dealt with later.
I mainly want to avoid more churn when people will inevitably
start sending patches to replace snprintf with strscpy.
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH bpf v2 15/15] selftests/bpf: Don't override SIGSEGV handler with ASAN
2026-02-18 0:30 [PATCH bpf v2 00/15] selftests/bpf: Fixes for userspace ASAN Ihor Solodrai
` (13 preceding siblings ...)
2026-02-18 0:30 ` [PATCH bpf v2 14/15] selftests/bpf: Check BPFTOOL env var in detect_bpftool_path() Ihor Solodrai
@ 2026-02-18 0:30 ` Ihor Solodrai
2026-02-18 15:12 ` Mykyta Yatsenko
14 siblings, 1 reply; 28+ messages in thread
From: Ihor Solodrai @ 2026-02-18 0:30 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko, Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
test_progs has custom SIGSEGV handler, which interferes with the
address sanitizer [1]. Add an #ifndef to avoid this.
[1] https://lore.kernel.org/bpf/73d832948b01dbc0ebc60d85574bdf8537f3a810.camel@gmail.com/
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
tools/testing/selftests/bpf/test_progs.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 02a85dda30e6..b533cede933d 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1944,13 +1944,15 @@ int main(int argc, char **argv)
.parser = parse_arg,
.doc = argp_program_doc,
};
+ int err, i;
+
+#ifndef __SANITIZE_ADDRESS__
struct sigaction sigact = {
.sa_handler = crash_handler,
.sa_flags = SA_RESETHAND,
- };
- int err, i;
-
+ };
sigaction(SIGSEGV, &sigact, NULL);
+#endif
env.stdout_saved = stdout;
env.stderr_saved = stderr;
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH bpf v2 15/15] selftests/bpf: Don't override SIGSEGV handler with ASAN
2026-02-18 0:30 ` [PATCH bpf v2 15/15] selftests/bpf: Don't override SIGSEGV handler with ASAN Ihor Solodrai
@ 2026-02-18 15:12 ` Mykyta Yatsenko
2026-02-20 0:36 ` Eduard Zingerman
0 siblings, 1 reply; 28+ messages in thread
From: Mykyta Yatsenko @ 2026-02-18 15:12 UTC (permalink / raw)
To: Ihor Solodrai, Alexei Starovoitov, Andrii Nakryiko,
Daniel Borkmann, Eduard Zingerman, Jiri Olsa, Mykyta Yatsenko,
Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
On 2/18/26 00:30, Ihor Solodrai wrote:
> test_progs has custom SIGSEGV handler, which interferes with the
> address sanitizer [1]. Add an #ifndef to avoid this.
>
> [1] https://lore.kernel.org/bpf/73d832948b01dbc0ebc60d85574bdf8537f3a810.camel@gmail.com/
>
> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
> ---
> tools/testing/selftests/bpf/test_progs.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
> index 02a85dda30e6..b533cede933d 100644
> --- a/tools/testing/selftests/bpf/test_progs.c
> +++ b/tools/testing/selftests/bpf/test_progs.c
> @@ -1944,13 +1944,15 @@ int main(int argc, char **argv)
> .parser = parse_arg,
> .doc = argp_program_doc,
> };
> + int err, i;
> +
> +#ifndef __SANITIZE_ADDRESS__
> struct sigaction sigact = {
> .sa_handler = crash_handler,
> .sa_flags = SA_RESETHAND,
> - };
> - int err, i;
> -
> + };
> sigaction(SIGSEGV, &sigact, NULL);
> +#endif
>
> env.stdout_saved = stdout;
> env.stderr_saved = stderr;
I think this is reasonable for the use case. We may try dumping logs
in |__asan_on_error(), if that proves useful.
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>|
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [PATCH bpf v2 15/15] selftests/bpf: Don't override SIGSEGV handler with ASAN
2026-02-18 15:12 ` Mykyta Yatsenko
@ 2026-02-20 0:36 ` Eduard Zingerman
0 siblings, 0 replies; 28+ messages in thread
From: Eduard Zingerman @ 2026-02-20 0:36 UTC (permalink / raw)
To: Mykyta Yatsenko, Ihor Solodrai, Alexei Starovoitov,
Andrii Nakryiko, Daniel Borkmann, Jiri Olsa, Mykyta Yatsenko,
Alexis Lothoré
Cc: Amery Hung, bpf, linux-kernel, kernel-team
On Wed, 2026-02-18 at 15:12 +0000, Mykyta Yatsenko wrote:
> On 2/18/26 00:30, Ihor Solodrai wrote:
> > test_progs has custom SIGSEGV handler, which interferes with the
> > address sanitizer [1]. Add an #ifndef to avoid this.
> >
> > [1] https://lore.kernel.org/bpf/73d832948b01dbc0ebc60d85574bdf8537f3a810.camel@gmail.com/
> >
> > Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
> > ---
> > tools/testing/selftests/bpf/test_progs.c | 8 +++++---
> > 1 file changed, 5 insertions(+), 3 deletions(-)
> >
> > diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
> > index 02a85dda30e6..b533cede933d 100644
> > --- a/tools/testing/selftests/bpf/test_progs.c
> > +++ b/tools/testing/selftests/bpf/test_progs.c
> > @@ -1944,13 +1944,15 @@ int main(int argc, char **argv)
> > .parser = parse_arg,
> > .doc = argp_program_doc,
> > };
> > + int err, i;
> > +
> > +#ifndef __SANITIZE_ADDRESS__
> > struct sigaction sigact = {
> > .sa_handler = crash_handler,
> > .sa_flags = SA_RESETHAND,
> > - };
> > - int err, i;
> > -
> > + };
> > sigaction(SIGSEGV, &sigact, NULL);
> > +#endif
> >
> > env.stdout_saved = stdout;
> > env.stderr_saved = stderr;
> I think this is reasonable for the use case. We may try dumping logs
> in |__asan_on_error(), if that proves useful.
> Acked-by: Mykyta Yatsenko <yatsenko@meta.com>|
Agree with Mykyta, crash_handler() can be split in two parts and
__asan_on_error() can be defined, calling the part doing
dump_test_log().
^ permalink raw reply [flat|nested] 28+ messages in thread