Re: [PATCH bpf-next v4 4/4] selftests/bpf: Add tests to verify freeing the special fields when update hash and local storage maps

[Yonghong Song]

On 11/4/25 6:14 PM, Leon Hwang wrote:
> On 5/11/25 01:30, Yonghong Song wrote:
> > On 10/30/25 8:24 AM, Leon Hwang wrote:
> > > Add tests to verify that updating hash and local storage maps decrements
> > > refcount when BPF_KPTR_REF objects are involved.
> > >
> > > The tests perform the following steps:
> > >
> > > 1. Call update_elem() to insert an initial value.
> > > 2. Use bpf_refcount_acquire() to increment the refcount.
> > > 3. Store the node pointer in the map value.
> > > 4. Add the node to a linked list.
> > > 5. Probe-read the refcount and verify it is *2*.
> > > 6. Call update_elem() again to trigger refcount decrement.
> > > 7. Probe-read the refcount and verify it is *1*.
> > >
> > > Signed-off-by: Leon Hwang <leon.hwang@xxxxxxxxx>
> > I applied this patch only (i.e., not including patches 1/2/3) to master
> > branch and do bpf selftest and all tests succeeded.
> >
> > [root@arch-fb-vm1 bpf]# ./test_progs -t refcounted_kptr
> > #294/1   refcounted_kptr/insert_read_both: remove from tree + list:OK
> > ...
> > #294/18  refcounted_kptr/pcpu_hash_refcount_leak:OK
> > #294/19  refcounted_kptr/check_pcpu_hash_refcount:OK
> > #294/20  refcounted_kptr/hash_lock_refcount_leak:OK
> > #294/21  refcounted_kptr/check_hash_lock_refcount:OK
> > #294/22  refcounted_kptr/rbtree_sleepable_rcu:OK
> > #294/23  refcounted_kptr/rbtree_sleepable_rcu_no_explicit_rcu_lock:OK
> > #294/24  refcounted_kptr/cgroup_storage_lock_refcount_leak:OK
> > #294/25  refcounted_kptr/check_cgroup_storage_lock_refcount:OK
> > ...
> >
> > Did I miss anything?
> Oops.
>
> You should run:
> ./test_progs -t kptr_refcount
>
> The results are as follows:
>
> test_percpu_hash_refcount_leak:PASS:libbpf_num_possible_cpus 0 nsec
> test_percpu_hash_refcount_leak:PASS:calloc values 0 nsec
> test_percpu_hash_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:PASS:refcount 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
> #158/1   kptr_refcount_leak/percpu_hash_refcount_leak:FAIL
> test_hash_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:PASS:refcount 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
> #158/2   kptr_refcount_leak/hash_lock_refcount_leak:FAIL
> test_cgroup_storage_lock_refcount_leak:PASS:setup_cgroup_environment 0 nsec
> test_cgroup_storage_lock_refcount_leak:PASS:get_root_cgroup 0 nsec
> test_cgroup_storage_lock_refcount_leak:PASS:refcounted_kptr__open_and_load
> 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:PASS:refcount 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
> #158/3   kptr_refcount_leak/cgroup_storage_lock_refcount_leak:FAIL
> #158     kptr_refcount_leak:FAIL
>
> All error logs:
> test_percpu_hash_refcount_leak:PASS:libbpf_num_possible_cpus 0 nsec
> test_percpu_hash_refcount_leak:PASS:calloc values 0 nsec
> test_percpu_hash_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:PASS:refcount 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
> #158/1   kptr_refcount_leak/percpu_hash_refcount_leak:FAIL
> test_hash_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:PASS:refcount 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
> #158/2   kptr_refcount_leak/hash_lock_refcount_leak:FAIL
> test_cgroup_storage_lock_refcount_leak:PASS:setup_cgroup_environment 0 nsec
> test_cgroup_storage_lock_refcount_leak:PASS:get_root_cgroup 0 nsec
> test_cgroup_storage_lock_refcount_leak:PASS:refcounted_kptr__open_and_load
> 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:PASS:refcount 0 nsec
> test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
> test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
> test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
> #158/3   kptr_refcount_leak/cgroup_storage_lock_refcount_leak:FAIL
> #158     kptr_refcount_leak:FAIL
> Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
>
> All three tests failed because the refcount remained 2 instead of
> decreasing to 1 after the second update_elem() call.
>
> The CI result [1] also demonstrates this issue.
>
> Sorry for the misleading test name earlier.

Sorry. It is my fault. Indeed, with patches 1-3, the tests indeed failed.
I obviously looked at the wrong selftest.

> Links:
> [1] https://github.com/kernel-patches/bpf/pull/10203
>
> Thanks,
> Leon
>
> [...]