Re: [PATCH bpf-next v4 4/4] selftests/bpf: Add tests to verify freeing the special fields when update hash and local storage maps

[Leon Hwang]

On 5/11/25 01:30, Yonghong Song wrote:
> 
> 
> On 10/30/25 8:24 AM, Leon Hwang wrote:
>> Add tests to verify that updating hash and local storage maps decrements
>> refcount when BPF_KPTR_REF objects are involved.
>>
>> The tests perform the following steps:
>>
>> 1. Call update_elem() to insert an initial value.
>> 2. Use bpf_refcount_acquire() to increment the refcount.
>> 3. Store the node pointer in the map value.
>> 4. Add the node to a linked list.
>> 5. Probe-read the refcount and verify it is *2*.
>> 6. Call update_elem() again to trigger refcount decrement.
>> 7. Probe-read the refcount and verify it is *1*.
>>
>> Signed-off-by: Leon Hwang <leon.hwang@xxxxxxxxx>
> 
> I applied this patch only (i.e., not including patches 1/2/3) to master
> branch and do bpf selftest and all tests succeeded.
> 
> [root@arch-fb-vm1 bpf]# ./test_progs -t refcounted_kptr
> #294/1   refcounted_kptr/insert_read_both: remove from tree + list:OK
> ...
> #294/18  refcounted_kptr/pcpu_hash_refcount_leak:OK
> #294/19  refcounted_kptr/check_pcpu_hash_refcount:OK
> #294/20  refcounted_kptr/hash_lock_refcount_leak:OK
> #294/21  refcounted_kptr/check_hash_lock_refcount:OK
> #294/22  refcounted_kptr/rbtree_sleepable_rcu:OK
> #294/23  refcounted_kptr/rbtree_sleepable_rcu_no_explicit_rcu_lock:OK
> #294/24  refcounted_kptr/cgroup_storage_lock_refcount_leak:OK
> #294/25  refcounted_kptr/check_cgroup_storage_lock_refcount:OK
> ...
> 
> Did I miss anything?
> 

Oops.

You should run:
./test_progs -t kptr_refcount

The results are as follows:

test_percpu_hash_refcount_leak:PASS:libbpf_num_possible_cpus 0 nsec
test_percpu_hash_refcount_leak:PASS:calloc values 0 nsec
test_percpu_hash_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec
test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
test_refcnt_leak:PASS:refcount 0 nsec
test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
#158/1   kptr_refcount_leak/percpu_hash_refcount_leak:FAIL
test_hash_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec
test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
test_refcnt_leak:PASS:refcount 0 nsec
test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
#158/2   kptr_refcount_leak/hash_lock_refcount_leak:FAIL
test_cgroup_storage_lock_refcount_leak:PASS:setup_cgroup_environment 0 nsec
test_cgroup_storage_lock_refcount_leak:PASS:get_root_cgroup 0 nsec
test_cgroup_storage_lock_refcount_leak:PASS:refcounted_kptr__open_and_load
0 nsec
test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
test_refcnt_leak:PASS:refcount 0 nsec
test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
#158/3   kptr_refcount_leak/cgroup_storage_lock_refcount_leak:FAIL
#158     kptr_refcount_leak:FAIL

All error logs:
test_percpu_hash_refcount_leak:PASS:libbpf_num_possible_cpus 0 nsec
test_percpu_hash_refcount_leak:PASS:calloc values 0 nsec
test_percpu_hash_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec
test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
test_refcnt_leak:PASS:refcount 0 nsec
test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
#158/1   kptr_refcount_leak/percpu_hash_refcount_leak:FAIL
test_hash_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec
test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
test_refcnt_leak:PASS:refcount 0 nsec
test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
#158/2   kptr_refcount_leak/hash_lock_refcount_leak:FAIL
test_cgroup_storage_lock_refcount_leak:PASS:setup_cgroup_environment 0 nsec
test_cgroup_storage_lock_refcount_leak:PASS:get_root_cgroup 0 nsec
test_cgroup_storage_lock_refcount_leak:PASS:refcounted_kptr__open_and_load
0 nsec
test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec
test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
test_refcnt_leak:PASS:refcount 0 nsec
test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec
test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec
test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1
#158/3   kptr_refcount_leak/cgroup_storage_lock_refcount_leak:FAIL
#158     kptr_refcount_leak:FAIL
Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED

All three tests failed because the refcount remained 2 instead of
decreasing to 1 after the second update_elem() call.

The CI result [1] also demonstrates this issue.

Sorry for the misleading test name earlier.

Links:
[1] https://github.com/kernel-patches/bpf/pull/10203

Thanks,
Leon

[...]