Re: [RFC PATCH bpf-next v2 09/11] selftests/bpf: Test using dynptr after freeing the underlying object

[Eduard Zingerman <eddyz87@gmail.com>]

On Fri, 2026-03-06 at 22:44 -0800, Amery Hung wrote:

[...]

> @@ -223,6 +253,12 @@ void test_ns_bpf_qdisc(void)
>  		test_qdisc_attach_to_non_root();
>  	if (test__start_subtest("incompl_ops"))
>  		test_incompl_ops();
> +	if (test__start_subtest("invalid_dynptr"))
> +		test_invalid_dynptr();
> +	if (test__start_subtest("invalid_dynptr_slice"))
> +		test_invalid_dynptr_slice();
> +	if (test__start_subtest("invalid_dynptr_cross_frame"))
> +		test_invalid_dynptr_cross_frame();
>  }

Nit:

maybe consider using test_loader.c based infrastructure for failure tests?
E.g. like below:

    +++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
    @@ -115,6 +115,7 @@
     #include "verifier_lsm.skel.h"
     #include "verifier_jit_inline.skel.h"
     #include "irq.skel.h"
    +#include "bpf_qdisc_fail__invalid_dynptr.skel.h"
     
     #define MAX_ENTRIES 11
     
    @@ -259,6 +260,7 @@ void test_verifier_lsm(void)                  { RUN(verifier_lsm); }
     void test_irq(void)			      { RUN(irq); }
     void test_verifier_mtu(void)		      { RUN(verifier_mtu); }
     void test_verifier_jit_inline(void)               { RUN(verifier_jit_inline); }
    +void test_bpf_qdisc_fail__invalid_dynptr(void) { RUN(bpf_qdisc_fail__invalid_dynptr); }
     
     static int init_test_val_map(struct bpf_object *obj, char *map_name)
     {
    diff --git a/tools/testing/selftests/bpf/progs/bpf_qdisc_fail__invalid_dynptr.c b/tools/testing/selftests/bpf/progs/bpf_qdisc_fail__invalid_dynptr.c
    index 2e76470bc261..f085872c3900 100644
    --- a/tools/testing/selftests/bpf/progs/bpf_qdisc_fail__invalid_dynptr.c
    +++ b/tools/testing/selftests/bpf/progs/bpf_qdisc_fail__invalid_dynptr.c
    @@ -3,12 +3,14 @@
     #include <vmlinux.h>
     #include "bpf_experimental.h"
     #include "bpf_qdisc_common.h"
    +#include "bpf_misc.h"
     
     char _license[] SEC("license") = "GPL";
     
     int proto;
     
     SEC("struct_ops")
    +__failure
     int BPF_PROG(bpf_qdisc_test_enqueue, struct sk_buff *skb, struct Qdisc *sch,
     	     struct bpf_sk_buff_ptr *to_free)
     {

For tests that exercise verifier failure messages this has some
benefits. E.g. the following command would reliably produce log
output even if program load succeeds:

  ./test_progs -vvv -a bpf_qdisc_fail__invalid_dynptr/bpf_qdisc_test_enqueue

And __msg annotations can be used to force-check the failure reason.

[...]