selftests/bpf: Fix list_del() in arena list

The __list_del fuction doesn't set the previous node's next pointer to
the next node of the node to be deleted. It just updates the local variable
and not the actual pointer in the previous node.

The test was passing up till now because the bpf code is doing bpf_free()
after list_del and therfore reading head->first from the userspace will
read all zeroes. But after arena_list_del() is finished, head->first should
point to NULL;

Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20251017141727.51355-1-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/testing/selftests/bpf/bpf_arena_list.h b/tools/testing/selftests/bpf/bpf_arena_list.h
index 85dbc3ea4da5f956e5ffd2cdb8ce9033072ff9b0..e16fa7d95fcf06ffa5000ce03b73b8e58f1d44b9 100644 (file)
--- a/tools/testing/selftests/bpf/bpf_arena_list.h
+++ b/tools/testing/selftests/bpf/bpf_arena_list.h
@@ -64,14 +64,12 @@ static inline void list_add_head(arena_list_node_t *n, arena_list_head_t *h)
 
 static inline void __list_del(arena_list_node_t *n)
 {
-       arena_list_node_t *next = n->next, *tmp;
+       arena_list_node_t *next = n->next;
        arena_list_node_t * __arena *pprev = n->pprev;
 
        cast_user(next);
        cast_kern(pprev);
-       tmp = *pprev;
-       cast_kern(tmp);
-       WRITE_ONCE(tmp, next);
+       WRITE_ONCE(*pprev, next);
        if (next) {
                cast_user(pprev);
                cast_kern(next);