[PATCH bpf-next 2/2] selftests/bpf: Add a test for udp_bpf_recvmsg() with a stuck backlog

[chenyuan_fl]

From: Yuan Chen <chenyuan@xxxxxxxxxx>

A sk_skb verdict program that redirects every skb back to the socket
itself keeps psock->ingress_skb populated: the backlog work re-sends
the skb out of that same socket, so it keeps coming back through the
receive path, and ingress_msg never receives anything.

Redirect targets must be in TCP_ESTABLISHED for non-TCP sockets
(sock_map_redirect_allowed()), so the test connects the UDP socket to
its own address; without that bpf_sk_redirect_map() turns every
redirect into SK_DROP and the backlog never fills up.

Reading on such a socket must fall back to the plain UDP receive path,
honor SO_RCVTIMEO and return -EAGAIN instead of spinning.  A re-sent
copy may still win the race against the verdict and be delivered; the
test accepts either outcome.

Run the scenario in a fork()ed child supervised by the parent, since
the spinning reader holds the socket lock and even SIGKILL cannot
reclaim it on an unfixed kernel.

Signed-off-by: Yuan Chen <chenyuan@xxxxxxxxxx>
---
 .../bpf/prog_tests/sockmap_udp_backlog.c      | 141 ++++++++++++++++++
 .../bpf/progs/test_sockmap_udp_backlog.c      |  21 +++
 2 files changed, 162 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/sockmap_udp_backlog.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_sockmap_udp_backlog.c

diff --git a/tools/testing/selftests/bpf/prog_tests/sockmap_udp_backlog.c b/tools/testing/selftests/bpf/prog_tests/sockmap_udp_backlog.c
new file mode 100644
index 000000000000..bbfe2623bd9e
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/sockmap_udp_backlog.c
@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2026 KylinSoft */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#include "test_progs.h"
+#include "test_sockmap_udp_backlog.skel.h"
+
+#define RCV_TIMEOUT_MS	1000
+#define HANG_LIMIT_MS	5000
+
+static int run_child(void)
+{
+	struct test_sockmap_udp_backlog *skel;
+	struct timeval tv = { .tv_sec = RCV_TIMEOUT_MS / 1000 };
+	struct sockaddr_in addr = {};
+	struct timespec t0, t1;
+	socklen_t addrlen = sizeof(addr);
+	int zero = 0, sfd, ret, err, exit_code = 1;
+	double elapsed_ms;
+	char byte = 0;
+
+	skel = test_sockmap_udp_backlog__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "skel_open_and_load"))
+		return 1;
+
+	sfd = socket(AF_INET, SOCK_DGRAM, 0);
+	if (!ASSERT_GE(sfd, 0, "socket"))
+		goto out;
+
+	addr.sin_family = AF_INET;
+	addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+	addr.sin_port = 0;
+	if (!ASSERT_OK(bind(sfd, (struct sockaddr *)&addr, sizeof(addr)), "bind"))
+		goto close;
+	addrlen = sizeof(addr);
+	if (!ASSERT_OK(getsockname(sfd, (struct sockaddr *)&addr, &addrlen),
+		       "getsockname"))
+		goto close;
+
+	/* Non-TCP redirect targets need TCP_ESTABLISHED: connect to self. */
+	if (!ASSERT_OK(connect(sfd, (struct sockaddr *)&addr, sizeof(addr)),
+		       "connect"))
+		goto close;
+
+	err = bpf_prog_attach(bpf_program__fd(skel->progs.redir_to_self),
+			      bpf_map__fd(skel->maps.sock_map),
+			      BPF_SK_SKB_VERDICT, 0);
+	if (!ASSERT_OK(err, "prog_attach"))
+		goto close;
+
+	err = bpf_map_update_elem(bpf_map__fd(skel->maps.sock_map),
+				  &zero, &sfd, BPF_ANY);
+	if (!ASSERT_OK(err, "map_update"))
+		goto close;
+
+	if (!ASSERT_EQ(send(sfd, &byte, 1, 0), 1, "send"))
+		goto close;
+
+	/* Let the backlog pick the skb up. */
+	usleep(100 * 1000);
+
+	err = setsockopt(sfd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
+	if (!ASSERT_OK(err, "set_rcvtimeo"))
+		goto close;
+
+	/* A re-sent copy may be read back; the reader must not spin. */
+	clock_gettime(CLOCK_MONOTONIC, &t0);
+	errno = 0;
+	ret = recv(sfd, &byte, 1, 0);
+	clock_gettime(CLOCK_MONOTONIC, &t1);
+	elapsed_ms = (t1.tv_sec - t0.tv_sec) * 1000.0 +
+		     (t1.tv_nsec - t0.tv_nsec) / 1000000.0;
+
+	if (ret != 1) {
+		if (!ASSERT_EQ(ret, -1, "recv"))
+			goto close;
+		if (!ASSERT_EQ(errno, EAGAIN, "recv_errno"))
+			goto close;
+		if (!ASSERT_GE(elapsed_ms, RCV_TIMEOUT_MS * 0.9, "recv_blocked"))
+			goto close;
+		if (!ASSERT_LT(elapsed_ms, HANG_LIMIT_MS, "recv_timely"))
+			goto close;
+	}
+
+	exit_code = 0;
+close:
+	close(sfd);
+out:
+	test_sockmap_udp_backlog__destroy(skel);
+	return exit_code;
+}
+
+void serial_test_sockmap_udp_backlog(void)
+{
+	pid_t pid;
+	int status = 0;
+	int i;
+
+	pid = fork();
+	if (!ASSERT_GE(pid, 0, "fork"))
+		return;
+
+	if (pid == 0)
+		_exit(run_child());
+
+	/* The child may survive SIGKILL: only a bounded wait is safe. */
+	for (i = 0; i < HANG_LIMIT_MS / 100; i++) {
+		if (waitpid(pid, &status, WNOHANG) == pid)
+			break;
+		usleep(100 * 1000);
+	}
+
+	if (i == HANG_LIMIT_MS / 100) {
+		kill(pid, SIGKILL);
+		for (i = 0; i < 10; i++) {
+			if (waitpid(pid, &status, WNOHANG) == pid)
+				break;
+			usleep(100 * 1000);
+		}
+		fprintf(stderr,
+			"udp_bpf_recvmsg() spins on backlog-only ingress (timeout %dms)\n",
+			HANG_LIMIT_MS);
+		test__fail();
+		return;
+	}
+
+	if (WIFEXITED(status)) {
+		ASSERT_EQ(WEXITSTATUS(status), 0, "child_exit_code");
+	} else {
+		fprintf(stderr, "child terminated abnormally (status=%d)\n", status);
+		test__fail();
+	}
+}
diff --git a/tools/testing/selftests/bpf/progs/test_sockmap_udp_backlog.c b/tools/testing/selftests/bpf/progs/test_sockmap_udp_backlog.c
new file mode 100644
index 000000000000..3459a66da3ba
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_sockmap_udp_backlog.c
@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2026 KylinSoft */
+
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+
+struct {
+	__uint(type, BPF_MAP_TYPE_SOCKMAP);
+	__uint(max_entries, 1);
+	__type(key, __u32);
+	__type(value, __u64);
+} sock_map SEC(".maps");
+
+/* Self-redirect: the backlog work keeps re-sending the skb. */
+SEC("sk_skb/verdict")
+int redir_to_self(struct __sk_buff *skb)
+{
+	return bpf_sk_redirect_map(skb, &sock_map, 0, 0);
+}
+
+char _license[] SEC("license") = "GPL";
-- 
2.54.0