Re: [PATCH bpf-next v4 4/4] selftests/bpf: Add tests to verify freeing the special fields when update hash and local storage maps

[Yonghong Song <yonghong.song@linux.dev>]

On 11/4/25 6:14 PM, Leon Hwang wrote:
>
> On 5/11/25 01:30, Yonghong Song wrote:
>>
>> On 10/30/25 8:24 AM, Leon Hwang wrote:
>>> Add tests to verify that updating hash and local storage maps decrements
>>> refcount when BPF_KPTR_REF objects are involved.
>>>
>>> The tests perform the following steps:
>>>
>>> 1. Call update_elem() to insert an initial value.
>>> 2. Use bpf_refcount_acquire() to increment the refcount.
>>> 3. Store the node pointer in the map value.
>>> 4. Add the node to a linked list.
>>> 5. Probe-read the refcount and verify it is *2*.
>>> 6. Call update_elem() again to trigger refcount decrement.
>>> 7. Probe-read the refcount and verify it is *1*.
>>>
>>> Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
>> I applied this patch only (i.e., not including patches 1/2/3) to master
>> branch and do bpf selftest and all tests succeeded.
>>
>> [root@arch-fb-vm1 bpf]# ./test_progs -t refcounted_kptr
>> #294/1   refcounted_kptr/insert_read_both: remove from tree + list:OK
>> ...
>> #294/18  refcounted_kptr/pcpu_hash_refcount_leak:OK
>> #294/19  refcounted_kptr/check_pcpu_hash_refcount:OK
>> #294/20  refcounted_kptr/hash_lock_refcount_leak:OK
>> #294/21  refcounted_kptr/check_hash_lock_refcount:OK
>> #294/22  refcounted_kptr/rbtree_sleepable_rcu:OK
>> #294/23  refcounted_kptr/rbtree_sleepable_rcu_no_explicit_rcu_lock:OK
>> #294/24  refcounted_kptr/cgroup_storage_lock_refcount_leak:OK
>> #294/25  refcounted_kptr/check_cgroup_storage_lock_refcount:OK
>> ...
>>
>> Did I miss anything?
>>
> Oops.
>
> You should run:
> ./test_progs -t kptr_refcount
>
> The results are as follows:
>
> test_percpu_hash_refcount_leak:PASS:libbpf_num_possible_cpus 0 nsec
> test_percpu_hash_refcount_leak:PASS:calloc values 0 nsec
> test_percpu_hash_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:PASS:refcount 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
> #158/1   kptr_refcount_leak/percpu_hash_refcount_leak:FAIL
> test_hash_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:PASS:refcount 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
> #158/2   kptr_refcount_leak/hash_lock_refcount_leak:FAIL
> test_cgroup_storage_lock_refcount_leak:PASS:setup_cgroup_environment 0 nsec
> test_cgroup_storage_lock_refcount_leak:PASS:get_root_cgroup 0 nsec
> test_cgroup_storage_lock_refcount_leak:PASS:refcounted_kptr__open_and_load
> 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:PASS:refcount 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
> #158/3   kptr_refcount_leak/cgroup_storage_lock_refcount_leak:FAIL
> #158     kptr_refcount_leak:FAIL
>
> All error logs:
> test_percpu_hash_refcount_leak:PASS:libbpf_num_possible_cpus 0 nsec
> test_percpu_hash_refcount_leak:PASS:calloc values 0 nsec
> test_percpu_hash_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:PASS:refcount 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
> #158/1   kptr_refcount_leak/percpu_hash_refcount_leak:FAIL
> test_hash_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:PASS:refcount 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
> #158/2   kptr_refcount_leak/hash_lock_refcount_leak:FAIL
> test_cgroup_storage_lock_refcount_leak:PASS:setup_cgroup_environment 0 nsec
> test_cgroup_storage_lock_refcount_leak:PASS:get_root_cgroup 0 nsec
> test_cgroup_storage_lock_refcount_leak:PASS:refcounted_kptr__open_and_load
> 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:PASS:refcount 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
> #158/3   kptr_refcount_leak/cgroup_storage_lock_refcount_leak:FAIL
> #158     kptr_refcount_leak:FAIL
> Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
>
> All three tests failed because the refcount remained 2 instead of
> decreasing to 1 after the second update_elem() call.
>
> The CI result [1] also demonstrates this issue.
>
> Sorry for the misleading test name earlier.

Sorry. It is my fault. Indeed, with patches 1-3, the tests indeed failed.
I obviously looked at the wrong selftest.

>
> Links:
> [1] https://github.com/kernel-patches/bpf/pull/10203
>
> Thanks,
> Leon
>
> [...]
>