bpf: Cancel special fields on map value recycle

Map update and delete paths currently call bpf_obj_free_fields() when a
value is being replaced or recycled. That makes field destruction depend
on the context of the update/delete operation. For tracing programs this
can include NMI context, where referenced kptr destructors, uptr
unpinning, and graph root destruction are not generally safe.

Introduce bpf_obj_cancel_fields() for the reusable-value path. It only
performs NMI-safe cleanup for timer, workqueue, and task_work fields.
Fields that need full destruction are left attached to the recycled value
and are destroyed by the final cleanup path instead.

Switch array and hashtab update/delete/recycle paths to this cancel
helper. Keep bpf_obj_free_fields() for final map destruction and for
bpf_mem_alloc destructors. Preallocated hashtabs do not have allocator
destructors, so teardown continues to walk the normal and extra elements
and fully destroy their fields.

This deliberately relaxes the eager-free semantics of map update/delete
for special fields. Programs that relied on a recycled map slot becoming
empty immediately after update/delete were relying on behavior that
cannot be implemented safely from every BPF execution context without
offloading arbitrary destructors.

There is a chance this change breaks programs making assumptions
regarding the eager freeing of fields. If so, we can relax semantics to
cancellation only when irqs_disabled() is true in the future. However,
theoretically, map values that get reused eagerly already have weaker
guarantees as parallel users can recreate freed fields before the new
element becomes visible again.

Fixes: 14a324f6a67e ("bpf: Wire up freeing of referenced kptr")
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
Co-developed-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260609202548.3571690-3-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 0654d2ffadc1efd99086676d313ba4fbacf546da..56f5da2b437f996cc6eb3dca8026eb8b39b2c24d 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -2717,6 +2717,7 @@ bool btf_record_equal(const struct btf_record *rec_a, const struct btf_record *r
 void bpf_obj_free_timer(const struct btf_record *rec, void *obj);
 void bpf_obj_free_workqueue(const struct btf_record *rec, void *obj);
 void bpf_obj_free_task_work(const struct btf_record *rec, void *obj);
+void bpf_obj_cancel_fields(struct bpf_map *map, void *obj);
 void bpf_obj_free_fields(const struct btf_record *rec, void *obj);
 void __bpf_obj_drop_impl(void *p, const struct btf_record *rec, bool percpu);
 

diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index e6271a2bf6d64b2df04ab33b93ce8360daed559d..248b4818178cd194f148da8237842fb56c89236b 100644 (file)
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -384,7 +384,7 @@ static long array_map_update_elem(struct bpf_map *map, void *key, void *value,
        if (array->map.map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
                val = this_cpu_ptr(array->pptrs[index & array->index_mask]);
                copy_map_value(map, val, value);
-               bpf_obj_free_fields(array->map.record, val);
+               bpf_obj_cancel_fields(map, val);
        } else {
                val = array->value +
                        (u64)array->elem_size * (index & array->index_mask);
@@ -392,7 +392,7 @@ static long array_map_update_elem(struct bpf_map *map, void *key, void *value,
                        copy_map_value_locked(map, val, value, false);
                else
                        copy_map_value(map, val, value);
-               bpf_obj_free_fields(array->map.record, val);
+               bpf_obj_cancel_fields(map, val);
        }
        return 0;
 }
@@ -432,14 +432,14 @@ int bpf_percpu_array_update(struct bpf_map *map, void *key, void *value,
                cpu = map_flags >> 32;
                ptr = per_cpu_ptr(pptr, cpu);
                copy_map_value(map, ptr, value);
-               bpf_obj_free_fields(array->map.record, ptr);
+               bpf_obj_cancel_fields(map, ptr);
                goto unlock;
        }
        for_each_possible_cpu(cpu) {
                ptr = per_cpu_ptr(pptr, cpu);
                val = (map_flags & BPF_F_ALL_CPUS) ? value : value + size * cpu;
                copy_map_value(map, ptr, val);
-               bpf_obj_free_fields(array->map.record, ptr);
+               bpf_obj_cancel_fields(map, ptr);
        }
 unlock:
        rcu_read_unlock();

diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index b4366cad3cfa5dc90b857ee7a09dbff2d2a1148a..9f394e1aa2e85be46fa5f12b6a5f5873e450e323 100644 (file)
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -243,6 +243,10 @@ static void htab_free_prealloced_fields(struct bpf_htab *htab)
 
        if (IS_ERR_OR_NULL(htab->map.record))
                return;
+       /*
+        * Preallocated maps do not have a bpf_mem_alloc destructor, so fully
+        * destroy every element, including the extra elements.
+        */
        if (htab_has_extra_elems(htab))
                num_entries += num_possible_cpus();
        for (i = 0; i < num_entries; i++) {
@@ -833,8 +837,8 @@ static int htab_lru_map_gen_lookup(struct bpf_map *map,
        return insn - insn_buf;
 }
 
-static void check_and_free_fields(struct bpf_htab *htab,
-                                 struct htab_elem *elem)
+static void check_and_cancel_fields(struct bpf_htab *htab,
+                                   struct htab_elem *elem)
 {
        if (IS_ERR_OR_NULL(htab->map.record))
                return;
@@ -844,11 +848,11 @@ static void check_and_free_fields(struct bpf_htab *htab,
                int cpu;
 
                for_each_possible_cpu(cpu)
-                       bpf_obj_free_fields(htab->map.record, per_cpu_ptr(pptr, cpu));
+                       bpf_obj_cancel_fields(&htab->map, per_cpu_ptr(pptr, cpu));
        } else {
                void *map_value = htab_elem_value(elem, htab->map.key_size);
 
-               bpf_obj_free_fields(htab->map.record, map_value);
+               bpf_obj_cancel_fields(&htab->map, map_value);
        }
 }
 
@@ -883,7 +887,7 @@ static bool htab_lru_map_delete_node(void *arg, struct bpf_lru_node *node)
        htab_unlock_bucket(b, flags);
 
        if (l == tgt_l)
-               check_and_free_fields(htab, l);
+               check_and_cancel_fields(htab, l);
        return l == tgt_l;
 }
 
@@ -948,7 +952,7 @@ find_first_elem:
 
 static void htab_elem_free(struct bpf_htab *htab, struct htab_elem *l)
 {
-       check_and_free_fields(htab, l);
+       check_and_cancel_fields(htab, l);
 
        if (htab->map.map_type == BPF_MAP_TYPE_PERCPU_HASH)
                bpf_mem_cache_free(&htab->pcpu_ma, l->ptr_to_pptr);
@@ -1001,7 +1005,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
 
        if (htab_is_prealloc(htab)) {
                bpf_map_dec_elem_count(&htab->map);
-               check_and_free_fields(htab, l);
+               check_and_cancel_fields(htab, l);
                pcpu_freelist_push(&htab->freelist, &l->fnode);
        } else {
                dec_elem_count(htab);
@@ -1018,7 +1022,7 @@ static void pcpu_copy_value(struct bpf_htab *htab, void __percpu *pptr,
                /* copy true value_size bytes */
                ptr = this_cpu_ptr(pptr);
                copy_map_value(&htab->map, ptr, value);
-               bpf_obj_free_fields(htab->map.record, ptr);
+               bpf_obj_cancel_fields(&htab->map, ptr);
        } else {
                u32 size = round_up(htab->map.value_size, 8);
                void *val;
@@ -1028,7 +1032,7 @@ static void pcpu_copy_value(struct bpf_htab *htab, void __percpu *pptr,
                        cpu = map_flags >> 32;
                        ptr = per_cpu_ptr(pptr, cpu);
                        copy_map_value(&htab->map, ptr, value);
-                       bpf_obj_free_fields(htab->map.record, ptr);
+                       bpf_obj_cancel_fields(&htab->map, ptr);
                        return;
                }
 
@@ -1036,7 +1040,7 @@ static void pcpu_copy_value(struct bpf_htab *htab, void __percpu *pptr,
                        ptr = per_cpu_ptr(pptr, cpu);
                        val = (map_flags & BPF_F_ALL_CPUS) ? value : value + size * cpu;
                        copy_map_value(&htab->map, ptr, val);
-                       bpf_obj_free_fields(htab->map.record, ptr);
+                       bpf_obj_cancel_fields(&htab->map, ptr);
                }
        }
 }
@@ -1252,11 +1256,11 @@ static long htab_map_update_elem(struct bpf_map *map, void *key, void *value,
        if (l_old) {
                hlist_nulls_del_rcu(&l_old->hash_node);
 
-               /* l_old has already been stashed in htab->extra_elems, free
-                * its special fields before it is available for reuse.
+               /* l_old has already been stashed in htab->extra_elems, cancel
+                * its reusable special fields before it is available for reuse.
                 */
                if (htab_is_prealloc(htab))
-                       check_and_free_fields(htab, l_old);
+                       check_and_cancel_fields(htab, l_old);
        }
        htab_unlock_bucket(b, flags);
        if (l_old && !htab_is_prealloc(htab))
@@ -1269,7 +1273,7 @@ err:
 
 static void htab_lru_push_free(struct bpf_htab *htab, struct htab_elem *elem)
 {
-       check_and_free_fields(htab, elem);
+       check_and_cancel_fields(htab, elem);
        bpf_map_dec_elem_count(&htab->map);
        bpf_lru_push_free(&htab->lru, &elem->lru_node);
 }

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index d4188a992bd8b19e54ae64c81e82d306eb247d12..7ed949f70f82c1c1be1c93cf57c8aef47a828fa2 100644 (file)
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -808,6 +808,11 @@ void bpf_obj_free_task_work(const struct btf_record *rec, void *obj)
        bpf_task_work_cancel_and_free(obj + rec->task_work_off);
 }
 
+void bpf_obj_cancel_fields(struct bpf_map *map, void *obj)
+{
+       bpf_map_free_internal_structs(map, obj);
+}
+
 void bpf_obj_free_fields(const struct btf_record *rec, void *obj)
 {
        const struct btf_field *fields;

diff --git a/tools/testing/selftests/bpf/prog_tests/htab_update.c b/tools/testing/selftests/bpf/prog_tests/htab_update.c
index ea1a6766fbe9872886abb532b62e96f94f66fba0..0a28d434692404091975199a7097d55ae5d09e99 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/htab_update.c
+++ b/tools/testing/selftests/bpf/prog_tests/htab_update.c
@@ -23,7 +23,7 @@ static void test_reenter_update(void)
        if (!ASSERT_OK_PTR(skel, "htab_update__open"))
                return;
 
-       bpf_program__set_autoload(skel->progs.bpf_obj_free_fields, true);
+       bpf_program__set_autoload(skel->progs.bpf_obj_cancel_fields, true);
        err = htab_update__load(skel);
        if (!ASSERT_TRUE(!err, "htab_update__load") || err)
                goto out;
@@ -50,7 +50,7 @@ static void test_reenter_update(void)
        /*
         * Second update: replace existing element with same key and trigger
         * the reentrancy of bpf_map_update_elem().
-        * check_and_free_fields() calls bpf_obj_free_fields() on the old
+        * check_and_cancel_fields() calls bpf_obj_cancel_fields() on the old
         * value, which is where fentry program runs and performs a nested
         * bpf_map_update_elem(), triggering -EDEADLK.
         */

diff --git a/tools/testing/selftests/bpf/prog_tests/linked_list.c b/tools/testing/selftests/bpf/prog_tests/linked_list.c
index dbff099860ba687cb0db80ecb8d12bf4bb224113..8defea0253ed9a9ba42529de37e90d3e390bb78b 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/linked_list.c
+++ b/tools/testing/selftests/bpf/prog_tests/linked_list.c
@@ -131,13 +131,14 @@ end:
        linked_list_fail__destroy(skel);
 }
 
-static void clear_fields(struct bpf_map *map)
+static void clear_fields(struct bpf_program *prog)
 {
-       char buf[24];
-       int key = 0;
+       LIBBPF_OPTS(bpf_test_run_opts, opts);
+       int ret;
 
-       memset(buf, 0xff, sizeof(buf));
-       ASSERT_OK(bpf_map__update_elem(map, &key, sizeof(key), buf, sizeof(buf), 0), "check_and_free_fields");
+       ret = bpf_prog_test_run_opts(bpf_program__fd(prog), &opts);
+       ASSERT_OK(ret, "clear_fields");
+       ASSERT_OK(opts.retval, "clear_fields retval");
 }
 
 enum {
@@ -170,31 +171,31 @@ static void test_linked_list_success(int mode, bool leave_in_map)
        ASSERT_OK(ret, "map_list_push_pop");
        ASSERT_OK(opts.retval, "map_list_push_pop retval");
        if (!leave_in_map)
-               clear_fields(skel->maps.array_map);
+               clear_fields(skel->progs.clear_map_list);
 
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.inner_map_list_push_pop), &opts);
        ASSERT_OK(ret, "inner_map_list_push_pop");
        ASSERT_OK(opts.retval, "inner_map_list_push_pop retval");
        if (!leave_in_map)
-               clear_fields(skel->maps.inner_map);
+               clear_fields(skel->progs.clear_inner_map_list);
 
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.global_list_push_pop), &opts);
        ASSERT_OK(ret, "global_list_push_pop");
        ASSERT_OK(opts.retval, "global_list_push_pop retval");
        if (!leave_in_map)
-               clear_fields(skel->maps.bss_A);
+               clear_fields(skel->progs.clear_global_list);
 
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.global_list_push_pop_nested), &opts);
        ASSERT_OK(ret, "global_list_push_pop_nested");
        ASSERT_OK(opts.retval, "global_list_push_pop_nested retval");
        if (!leave_in_map)
-               clear_fields(skel->maps.bss_A);
+               clear_fields(skel->progs.clear_global_nested_list);
 
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.global_list_array_push_pop), &opts);
        ASSERT_OK(ret, "global_list_array_push_pop");
        ASSERT_OK(opts.retval, "global_list_array_push_pop retval");
        if (!leave_in_map)
-               clear_fields(skel->maps.bss_A);
+               clear_fields(skel->progs.clear_global_array_list);
 
        if (mode == PUSH_POP)
                goto end;
@@ -204,19 +205,19 @@ ppm:
        ASSERT_OK(ret, "map_list_push_pop_multiple");
        ASSERT_OK(opts.retval, "map_list_push_pop_multiple retval");
        if (!leave_in_map)
-               clear_fields(skel->maps.array_map);
+               clear_fields(skel->progs.clear_map_list);
 
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.inner_map_list_push_pop_multiple), &opts);
        ASSERT_OK(ret, "inner_map_list_push_pop_multiple");
        ASSERT_OK(opts.retval, "inner_map_list_push_pop_multiple retval");
        if (!leave_in_map)
-               clear_fields(skel->maps.inner_map);
+               clear_fields(skel->progs.clear_inner_map_list);
 
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.global_list_push_pop_multiple), &opts);
        ASSERT_OK(ret, "global_list_push_pop_multiple");
        ASSERT_OK(opts.retval, "global_list_push_pop_multiple retval");
        if (!leave_in_map)
-               clear_fields(skel->maps.bss_A);
+               clear_fields(skel->progs.clear_global_list);
 
        if (mode == PUSH_POP_MULT)
                goto end;
@@ -226,19 +227,19 @@ lil:
        ASSERT_OK(ret, "map_list_in_list");
        ASSERT_OK(opts.retval, "map_list_in_list retval");
        if (!leave_in_map)
-               clear_fields(skel->maps.array_map);
+               clear_fields(skel->progs.clear_map_list);
 
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.inner_map_list_in_list), &opts);
        ASSERT_OK(ret, "inner_map_list_in_list");
        ASSERT_OK(opts.retval, "inner_map_list_in_list retval");
        if (!leave_in_map)
-               clear_fields(skel->maps.inner_map);
+               clear_fields(skel->progs.clear_inner_map_list);
 
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.global_list_in_list), &opts);
        ASSERT_OK(ret, "global_list_in_list");
        ASSERT_OK(opts.retval, "global_list_in_list retval");
        if (!leave_in_map)
-               clear_fields(skel->maps.bss_A);
+               clear_fields(skel->progs.clear_global_list);
 end:
        linked_list__destroy(skel);
 }

diff --git a/tools/testing/selftests/bpf/prog_tests/map_kptr.c b/tools/testing/selftests/bpf/prog_tests/map_kptr.c
index 03b46f17cf537510f1c27d9272c7236f53db1e3c..ec6f2f2e830896e9908f1fc6c217a3af91bf2ed2 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/map_kptr.c
+++ b/tools/testing/selftests/bpf/prog_tests/map_kptr.c
@@ -51,7 +51,6 @@ static void test_map_kptr_success(bool test_run)
        ret = bpf_map__update_elem(skel->maps.array_map,
                                   &key, sizeof(key), buf, sizeof(buf), 0);
        ASSERT_OK(ret, "array_map update");
-       skel->data->ref--;
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.test_map_kptr_ref3), &opts);
        ASSERT_OK(ret, "test_map_kptr_ref3 refcount");
        ASSERT_OK(opts.retval, "test_map_kptr_ref3 retval");
@@ -59,49 +58,42 @@ static void test_map_kptr_success(bool test_run)
        ret = bpf_map__update_elem(skel->maps.pcpu_array_map,
                                   &key, sizeof(key), pbuf, cpu * sizeof(buf), 0);
        ASSERT_OK(ret, "pcpu_array_map update");
-       skel->data->ref--;
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.test_map_kptr_ref3), &opts);
        ASSERT_OK(ret, "test_map_kptr_ref3 refcount");
        ASSERT_OK(opts.retval, "test_map_kptr_ref3 retval");
 
        ret = bpf_map__delete_elem(skel->maps.hash_map, &key, sizeof(key), 0);
        ASSERT_OK(ret, "hash_map delete");
-       skel->data->ref--;
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.test_map_kptr_ref3), &opts);
        ASSERT_OK(ret, "test_map_kptr_ref3 refcount");
        ASSERT_OK(opts.retval, "test_map_kptr_ref3 retval");
 
        ret = bpf_map__delete_elem(skel->maps.pcpu_hash_map, &key, sizeof(key), 0);
        ASSERT_OK(ret, "pcpu_hash_map delete");
-       skel->data->ref--;
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.test_map_kptr_ref3), &opts);
        ASSERT_OK(ret, "test_map_kptr_ref3 refcount");
        ASSERT_OK(opts.retval, "test_map_kptr_ref3 retval");
 
        ret = bpf_map__delete_elem(skel->maps.hash_malloc_map, &key, sizeof(key), 0);
        ASSERT_OK(ret, "hash_malloc_map delete");
-       skel->data->ref--;
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.test_map_kptr_ref3), &opts);
        ASSERT_OK(ret, "test_map_kptr_ref3 refcount");
        ASSERT_OK(opts.retval, "test_map_kptr_ref3 retval");
 
        ret = bpf_map__delete_elem(skel->maps.pcpu_hash_malloc_map, &key, sizeof(key), 0);
        ASSERT_OK(ret, "pcpu_hash_malloc_map delete");
-       skel->data->ref--;
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.test_map_kptr_ref3), &opts);
        ASSERT_OK(ret, "test_map_kptr_ref3 refcount");
        ASSERT_OK(opts.retval, "test_map_kptr_ref3 retval");
 
        ret = bpf_map__delete_elem(skel->maps.lru_hash_map, &key, sizeof(key), 0);
        ASSERT_OK(ret, "lru_hash_map delete");
-       skel->data->ref--;
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.test_map_kptr_ref3), &opts);
        ASSERT_OK(ret, "test_map_kptr_ref3 refcount");
        ASSERT_OK(opts.retval, "test_map_kptr_ref3 retval");
 
        ret = bpf_map__delete_elem(skel->maps.lru_pcpu_hash_map, &key, sizeof(key), 0);
        ASSERT_OK(ret, "lru_pcpu_hash_map delete");
-       skel->data->ref--;
        ret = bpf_prog_test_run_opts(bpf_program__fd(skel->progs.test_map_kptr_ref3), &opts);
        ASSERT_OK(ret, "test_map_kptr_ref3 refcount");
        ASSERT_OK(opts.retval, "test_map_kptr_ref3 retval");
@@ -175,7 +167,7 @@ void serial_test_map_kptr(void)
                ASSERT_OK(kern_sync_rcu(), "sync rcu");
                wait_for_map_release();
 
-               /* Observe refcount dropping to 1 on synchronous delete elem */
+               /* Observe refcount dropping to 1 on map release. */
                test_map_kptr_success(true);
        }
 

diff --git a/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c b/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c
index d2c0542716a848c6205ab0f661a613a13ae80181..1737eba3432343a40948e8e86659c5542c561228 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c
+++ b/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c
@@ -57,6 +57,7 @@ void test_percpu_hash_refcounted_kptr_refcount_leak(void)
                    .data_size_in = sizeof(pkt_v4),
                    .repeat = 1,
        );
+       LIBBPF_OPTS(bpf_test_run_opts, syscall_opts);
 
        cpu_nr = libbpf_num_possible_cpus();
        if (!ASSERT_GT(cpu_nr, 0, "libbpf_num_possible_cpus"))
@@ -87,8 +88,11 @@ void test_percpu_hash_refcounted_kptr_refcount_leak(void)
        if (!ASSERT_EQ(opts.retval, 2, "opts.retval"))
                goto out;
 
-       err = bpf_map__update_elem(map, &key, sizeof(key), values, values_sz, 0);
-       if (!ASSERT_OK(err, "bpf_map__update_elem"))
+       fd = bpf_program__fd(skel->progs.clear_percpu_hash_kptr);
+       err = bpf_prog_test_run_opts(fd, &syscall_opts);
+       if (!ASSERT_OK(err, "bpf_prog_test_run_opts"))
+               goto out;
+       if (!ASSERT_EQ(syscall_opts.retval, 1, "syscall_opts.retval"))
                goto out;
 
        fd = bpf_program__fd(skel->progs.check_percpu_hash_refcount);

diff --git a/tools/testing/selftests/bpf/progs/htab_update.c b/tools/testing/selftests/bpf/progs/htab_update.c
index 195d3b2fba00c502cf0294b14958b07fd340097f..62c1b1325ec27bb16f008da0079ed0cb813bc5c2 100644 (file)
--- a/tools/testing/selftests/bpf/progs/htab_update.c
+++ b/tools/testing/selftests/bpf/progs/htab_update.c
@@ -22,8 +22,8 @@ struct {
 int pid = 0;
 int update_err = 0;
 
-SEC("?fentry/bpf_obj_free_fields")
-int bpf_obj_free_fields(void *ctx)
+SEC("?fentry/bpf_obj_cancel_fields")
+int bpf_obj_cancel_fields(void *ctx)
 {
        __u32 key = 0;
        struct val value = { .payload = 1 };

diff --git a/tools/testing/selftests/bpf/progs/linked_list.c b/tools/testing/selftests/bpf/progs/linked_list.c
index 421f40835acd75927b1e11e6d46ae37139cfa64b..fa97faa5358bcae507b1e4e8c50102fdc54e61c4 100644 (file)
--- a/tools/testing/selftests/bpf/progs/linked_list.c
+++ b/tools/testing/selftests/bpf/progs/linked_list.c
@@ -290,6 +290,77 @@ int test_list_in_list(struct bpf_spin_lock *lock, struct bpf_list_head *head)
        return list_in_list(lock, head, true);
 }
 
+#define MAX_LIST_CLEAR_NODES 256
+
+static __always_inline
+int clear_list(struct bpf_spin_lock *lock, struct bpf_list_head *head)
+{
+       struct bpf_list_node *n;
+       int i;
+
+       for (i = 0; i < MAX_LIST_CLEAR_NODES; i++) {
+               bpf_spin_lock(lock);
+               n = bpf_list_pop_front(head);
+               bpf_spin_unlock(lock);
+               if (!n)
+                       return 0;
+               bpf_obj_drop(container_of(n, struct foo, node2));
+       }
+       return 1;
+}
+
+SEC("syscall")
+int clear_map_list(void *ctx)
+{
+       struct map_value *v;
+
+       v = bpf_map_lookup_elem(&array_map, &(int){0});
+       if (!v)
+               return 1;
+       return clear_list(&v->lock, &v->head);
+}
+
+SEC("syscall")
+int clear_inner_map_list(void *ctx)
+{
+       struct map_value *v;
+       void *map;
+
+       map = bpf_map_lookup_elem(&map_of_maps, &(int){0});
+       if (!map)
+               return 1;
+       v = bpf_map_lookup_elem(map, &(int){0});
+       if (!v)
+               return 1;
+       return clear_list(&v->lock, &v->head);
+}
+
+SEC("syscall")
+int clear_global_list(void *ctx)
+{
+       return clear_list(&glock, &ghead);
+}
+
+SEC("syscall")
+int clear_global_nested_list(void *ctx)
+{
+       return clear_list(&ghead_nested.inner.lock, &ghead_nested.inner.head);
+}
+
+SEC("syscall")
+int clear_global_array_list(void *ctx)
+{
+       int ret;
+
+       ret = clear_list(&glock_c, &ghead_array[0]);
+       if (ret)
+               return ret;
+       ret = clear_list(&glock_c, &ghead_array[1]);
+       if (ret)
+               return ret;
+       return clear_list(&glock_c, &ghead_array_one[0]);
+}
+
 SEC("tc")
 int map_list_push_pop(void *ctx)
 {

diff --git a/tools/testing/selftests/bpf/progs/refcounted_kptr.c b/tools/testing/selftests/bpf/progs/refcounted_kptr.c
index 13de169ad68f6c11dfdfc66b6b4e308f5b47b120..61906f48025cc723419675d816e25487d0144bf4 100644 (file)
--- a/tools/testing/selftests/bpf/progs/refcounted_kptr.c
+++ b/tools/testing/selftests/bpf/progs/refcounted_kptr.c
@@ -1036,13 +1036,31 @@ int percpu_hash_refcount_leak(void *ctx)
        struct map_value *v;
        int key = 0;
 
-       v = bpf_map_lookup_elem(&percpu_hash, &key);
+       v = bpf_map_lookup_percpu_elem(&percpu_hash, &key, 0);
        if (!v)
                return 0;
 
        return __insert_in_list(&head, &lock, &v->node);
 }
 
+SEC("syscall")
+int clear_percpu_hash_kptr(void *ctx)
+{
+       struct node_data *n;
+       struct map_value *v;
+       int key = 0;
+
+       v = bpf_map_lookup_percpu_elem(&percpu_hash, &key, 0);
+       if (!v)
+               return 0;
+
+       n = bpf_kptr_xchg(&v->node, NULL);
+       if (!n)
+               return 0;
+       bpf_obj_drop(n);
+       return probe_read_refcount();
+}
+
 SEC("tc")
 int check_percpu_hash_refcount(void *ctx)
 {