On Fri, Feb 14, 2025 at 5:14 PM Martin KaFai Lau <martin.lau@xxxxxxxxx> wrote:
>
> On 2/14/25 8:45 AM, Amery Hung wrote:
> > diff --git a/tools/testing/selftests/bpf/progs/struct_ops_refcounted_fail__global_subprog.c b/tools/testing/selftests/bpf/progs/struct_ops_refcounted_fail__global_subprog.c
> > new file mode 100644
> > index 000000000000..ae074aa62852
> > --- /dev/null
> > +++ b/tools/testing/selftests/bpf/progs/struct_ops_refcounted_fail__global_subprog.c
> > @@ -0,0 +1,39 @@
> > +#include <vmlinux.h>
> > +#include <bpf/bpf_tracing.h>
> > +#include "../test_kmods/bpf_testmod.h"
> > +#include "bpf_misc.h"
> > +
> > +char _license[] SEC("license") = "GPL";
> > +
> > +extern void bpf_task_release(struct task_struct *p) __ksym;
> > +
> > +__noinline int subprog_release(__u64 *ctx __arg_ctx)
> > +{
> > + struct task_struct *task = (struct task_struct *)ctx[1];
> > + int dummy = (int)ctx[0];
> > +
> > + bpf_task_release(task);
> > +
> > + return dummy + 1;
> > +}
> > +
> > +/* Test that the verifier rejects a program that contains a global
> > + * subprogram with referenced kptr arguments
> > + */
> > +SEC("struct_ops/test_refcounted")
> > +__failure __log_level(2)
> > +__msg("Validating subprog_release() func#1...")
> > +__msg("invalid bpf_context access off=8. Reference may already be released")
> > +int refcounted_fail__global_subprog(unsigned long long *ctx)
> > +{
> > + struct task_struct *task = (struct task_struct *)ctx[1];
> > +
> > + bpf_task_release(task);
> > +
> > + return subprog_release(ctx);
>
> One question, swap the subprog_release and bpf_task_release order will still be
> the same failure, right? Meaning:
>
That is correct. Main program first will still pass the verification
and then the global subprogram will still fail due to the same
!find_reference_state error.
> subprog_release(ctx);
>
> bpf_task_release(task);
>
> return 0;
>
> which is fine based on the changes in the do_check_common() in patch 2. Just
> want to confirm my understanding.
>
> Other than that,
>
> Acked-by: Martin KaFai Lau <martin.lau@xxxxxxxxxx>
