The bad_sched test covers one socket type confusion: a subflow TCP
socket passed to bpf_mptcp_set_timeout(), which takes a struct
mptcp_sock *. Extend it into a small suite that guards the narrow-typed
scheduler kfunc surface against that bug class, covering both confusion
directions:

  - a subflow sock passed to mptcp_wnd_end() (struct mptcp_sock *), the
    same direction as the set_timeout case;
  - the msk passed to mptcp_subflow_set_scheduled() (struct
    mptcp_subflow_context *), the inverse direction.

Each malicious scheduler is its own struct_ops map. They are loaded one
at a time via bpf_map__set_autocreate(), so each load failure is checked
against its own verifier type-mismatch message.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
---
 tools/testing/selftests/bpf/prog_tests/mptcp.c     | 56 ++++++++++++++++------
 .../selftests/bpf/progs/mptcp_bpf_bad_sched.c      | 48 +++++++++++++++++++
 2 files changed, 89 insertions(+), 15 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/mptcp.c b/tools/testing/selftests/bpf/prog_tests/mptcp.c
index 177e5318029d4..6f5d8f3ac784f 100644
--- a/tools/testing/selftests/bpf/prog_tests/mptcp.c
+++ b/tools/testing/selftests/bpf/prog_tests/mptcp.c
@@ -814,32 +814,58 @@ static void test_burst(void)
 	mptcp_bpf_burst__destroy(skel);
 }
 
-static void test_bad_sched(void)
+static void load_bad_sched(struct mptcp_bpf_bad_sched *skel, const char *msg)
 {
-	struct mptcp_bpf_bad_sched *skel;
 	char *log = NULL;
 	int err;
 
+	if (start_libbpf_log_capture())
+		return;
+
+	err = mptcp_bpf_bad_sched__load(skel);
+	log = stop_libbpf_log_capture();
+	ASSERT_ERR(err, "load: bad scheduler must be rejected");
+	ASSERT_HAS_SUBSTR(log, msg, "verifier type-mismatch message");
+	free(log);
+}
+
+static void test_bad_sched(void)
+{
+	struct mptcp_bpf_bad_sched *skel;
+
 	/*
-	 * bad_sched_get_send() passes a subflow TCP socket to
-	 * bpf_mptcp_set_timeout(), which takes a struct mptcp_sock *. The
-	 * verifier must reject this socket type confusion at load time, and
-	 * for the right reason: assert the specific verifier message.
+	 * Each scheduler in mptcp_bpf_bad_sched passes a wrong-subtype socket
+	 * to a narrow-typed scheduler kfunc; the verifier must reject each at
+	 * load time with the specific type-mismatch message. The skel holds
+	 * several such schedulers, so enable one struct_ops map at a time;
+	 * loading them together would fail atomically.
 	 */
+
+	/* subflow sock -> bpf_mptcp_set_timeout(struct mptcp_sock *) */
 	skel = mptcp_bpf_bad_sched__open();
 	if (!ASSERT_OK_PTR(skel, "open: bad_sched"))
 		return;
+	bpf_map__set_autocreate(skel->maps.bad_wnd_end, false);
+	bpf_map__set_autocreate(skel->maps.bad_set_sched, false);
+	load_bad_sched(skel, "expected pointer to STRUCT mptcp_sock");
+	mptcp_bpf_bad_sched__destroy(skel);
 
-	if (start_libbpf_log_capture())
-		goto destroy;
+	/* subflow sock -> mptcp_wnd_end(struct mptcp_sock *) */
+	skel = mptcp_bpf_bad_sched__open();
+	if (!ASSERT_OK_PTR(skel, "open: bad_wnd_end"))
+		return;
+	bpf_map__set_autocreate(skel->maps.bad_sched, false);
+	bpf_map__set_autocreate(skel->maps.bad_set_sched, false);
+	load_bad_sched(skel, "expected pointer to STRUCT mptcp_sock");
+	mptcp_bpf_bad_sched__destroy(skel);
 
-	err = mptcp_bpf_bad_sched__load(skel);
-	log = stop_libbpf_log_capture();
-	ASSERT_ERR(err, "load: bad_sched must be rejected");
-	ASSERT_HAS_SUBSTR(log, "expected pointer to STRUCT mptcp_sock",
-			  "verifier rejects subflow sock to bpf_mptcp_set_timeout");
-	free(log);
-destroy:
+	/* msk -> mptcp_subflow_set_scheduled(struct mptcp_subflow_context *) */
+	skel = mptcp_bpf_bad_sched__open();
+	if (!ASSERT_OK_PTR(skel, "open: bad_set_sched"))
+		return;
+	bpf_map__set_autocreate(skel->maps.bad_sched, false);
+	bpf_map__set_autocreate(skel->maps.bad_wnd_end, false);
+	load_bad_sched(skel, "expected pointer to STRUCT mptcp_subflow_context");
 	mptcp_bpf_bad_sched__destroy(skel);
 }
 
diff --git a/tools/testing/selftests/bpf/progs/mptcp_bpf_bad_sched.c b/tools/testing/selftests/bpf/progs/mptcp_bpf_bad_sched.c
index 70e7da42f13a9..a744de8b82859 100644
--- a/tools/testing/selftests/bpf/progs/mptcp_bpf_bad_sched.c
+++ b/tools/testing/selftests/bpf/progs/mptcp_bpf_bad_sched.c
@@ -12,6 +12,7 @@
 char _license[] SEC("license") = "GPL";
 
 extern void bpf_mptcp_set_timeout(struct mptcp_sock *msk) __ksym;
+extern __u64 mptcp_wnd_end(const struct mptcp_sock *msk) __ksym;
 
 SEC("struct_ops")
 void BPF_PROG(bad_sched_init, struct mptcp_sock *msk)
@@ -54,3 +55,50 @@ struct mptcp_sched_ops bad_sched = {
 	.get_send	= (void *)bad_sched_get_send,
 	.name		= "bpf_bad_sched",
 };
+
+/*
+ * Same confusion class as bad_sched, on another struct mptcp_sock * kfunc:
+ * feed a subflow TCP socket to mptcp_wnd_end(). The verifier must reject it
+ * ("expected pointer to STRUCT mptcp_sock"). get_send is the only required
+ * scheduler op, so the rest are omitted.
+ */
+SEC("struct_ops")
+int BPF_PROG(bad_wnd_end_get_send, struct mptcp_sock *msk)
+{
+	struct mptcp_subflow_context *subflow;
+	struct sock *ssk;
+
+	bpf_for_each(mptcp_subflow, subflow, (struct sock *)msk) {
+		ssk = bpf_mptcp_subflow_tcp_sock(subflow);
+		if (!ssk)
+			return -1;
+		if (mptcp_wnd_end((struct mptcp_sock *)ssk))
+			return 0;
+		return -1;
+	}
+	return -1;
+}
+
+SEC(".struct_ops.link")
+struct mptcp_sched_ops bad_wnd_end = {
+	.get_send	= (void *)bad_wnd_end_get_send,
+	.name		= "bpf_bad_wnd_end",
+};
+
+/*
+ * Inverse confusion: feed the msk to mptcp_subflow_set_scheduled(), which
+ * takes a struct mptcp_subflow_context *. The verifier must reject it
+ * ("expected pointer to STRUCT mptcp_subflow_context").
+ */
+SEC("struct_ops")
+int BPF_PROG(bad_set_sched_get_send, struct mptcp_sock *msk)
+{
+	mptcp_subflow_set_scheduled((struct mptcp_subflow_context *)msk, true);
+	return 0;
+}
+
+SEC(".struct_ops.link")
+struct mptcp_sched_ops bad_set_sched = {
+	.get_send	= (void *)bad_set_sched_get_send,
+	.name		= "bpf_bad_set_sch",
+};

-- 
2.34.1