Add a negative test for the bpf_mptcp_set_timeout() kfunc: a BPF MPTCP
scheduler whose get_send() passes a subflow TCP socket to it, where the
kfunc takes a struct mptcp_sock *, must be rejected by the verifier at
program load time. This guards against widening the kfunc argument back
to a generic struct sock *, which would reintroduce the socket type
confusion between an MPTCP-level socket and a subflow TCP socket.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
---
tools/testing/selftests/bpf/prog_tests/mptcp.c | 32 +++++++++++++
.../selftests/bpf/progs/mptcp_bpf_bad_sched.c | 56 ++++++++++++++++++++++
2 files changed, 88 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/mptcp.c b/tools/testing/selftests/bpf/prog_tests/mptcp.c
index 7f48fd9e94e1e..177e5318029d4 100644
--- a/tools/testing/selftests/bpf/prog_tests/mptcp.c
+++ b/tools/testing/selftests/bpf/prog_tests/mptcp.c
@@ -18,6 +18,7 @@
#include "mptcp_bpf_rr.skel.h"
#include "mptcp_bpf_red.skel.h"
#include "mptcp_bpf_burst.skel.h"
+#include "mptcp_bpf_bad_sched.skel.h"
#define NS_TEST "mptcp_ns"
#define ADDR_1 "10.0.1.1"
@@ -813,6 +814,35 @@ static void test_burst(void)
mptcp_bpf_burst__destroy(skel);
}
+static void test_bad_sched(void)
+{
+ struct mptcp_bpf_bad_sched *skel;
+ char *log = NULL;
+ int err;
+
+ /*
+ * bad_sched_get_send() passes a subflow TCP socket to
+ * bpf_mptcp_set_timeout(), which takes a struct mptcp_sock *. The
+ * verifier must reject this socket type confusion at load time, and
+ * for the right reason: assert the specific verifier message.
+ */
+ skel = mptcp_bpf_bad_sched__open();
+ if (!ASSERT_OK_PTR(skel, "open: bad_sched"))
+ return;
+
+ if (start_libbpf_log_capture())
+ goto destroy;
+
+ err = mptcp_bpf_bad_sched__load(skel);
+ log = stop_libbpf_log_capture();
+ ASSERT_ERR(err, "load: bad_sched must be rejected");
+ ASSERT_HAS_SUBSTR(log, "expected pointer to STRUCT mptcp_sock",
+ "verifier rejects subflow sock to bpf_mptcp_set_timeout");
+ free(log);
+destroy:
+ mptcp_bpf_bad_sched__destroy(skel);
+}
+
void test_mptcp(void)
{
if (test__start_subtest("base"))
@@ -835,4 +865,6 @@ void test_mptcp(void)
test_red();
if (test__start_subtest("burst"))
test_burst();
+ if (test__start_subtest("bad_sched"))
+ test_bad_sched();
}
diff --git a/tools/testing/selftests/bpf/progs/mptcp_bpf_bad_sched.c b/tools/testing/selftests/bpf/progs/mptcp_bpf_bad_sched.c
new file mode 100644
index 0000000000000..70e7da42f13a9
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/mptcp_bpf_bad_sched.c
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2026, Mpiric Software. */
+
+/*
+ * A scheduler that passes a subflow TCP socket to bpf_mptcp_set_timeout(),
+ * which takes a struct mptcp_sock *. The verifier must reject this at load
+ * time; see the bad_sched subtest in prog_tests/mptcp.c.
+ */
+#include "mptcp_bpf.h"
+#include <bpf/bpf_tracing.h>
+
+char _license[] SEC("license") = "GPL";
+
+extern void bpf_mptcp_set_timeout(struct mptcp_sock *msk) __ksym;
+
+SEC("struct_ops")
+void BPF_PROG(bad_sched_init, struct mptcp_sock *msk)
+{
+}
+
+SEC("struct_ops")
+void BPF_PROG(bad_sched_release, struct mptcp_sock *msk)
+{
+}
+
+SEC("struct_ops")
+int BPF_PROG(bad_sched_get_send, struct mptcp_sock *msk)
+{
+ struct mptcp_subflow_context *subflow;
+ struct sock *ssk;
+
+ bpf_for_each(mptcp_subflow, subflow, (struct sock *)msk) {
+ ssk = bpf_mptcp_subflow_tcp_sock(subflow);
+ if (!ssk)
+ return -1;
+ /*
+ * ssk is a subflow TCP socket (struct sock *), not an msk.
+ * Passing it to bpf_mptcp_set_timeout(), which takes a
+ * struct mptcp_sock *, is a socket type confusion that the
+ * verifier must reject at load time ("expected pointer to
+ * STRUCT mptcp_sock").
+ */
+ bpf_mptcp_set_timeout((struct mptcp_sock *)ssk);
+ mptcp_subflow_set_scheduled(subflow, true);
+ return 0;
+ }
+ return -1;
+}
+
+SEC(".struct_ops.link")
+struct mptcp_sched_ops bad_sched = {
+ .init = (void *)bad_sched_init,
+ .release = (void *)bad_sched_release,
+ .get_send = (void *)bad_sched_get_send,
+ .name = "bpf_bad_sched",
+};
--
2.34.1