Add tests to verify that updating hash and local storage maps decrements
refcount when BPF_KPTR_REF objects are involved.
The tests perform the following steps:
1. Call update_elem() to insert an initial value.
2. Use bpf_refcount_acquire() to increment the refcount.
3. Store the node pointer in the map value.
4. Add the node to a linked list.
5. Probe-read the refcount and verify it is *2*.
6. Call update_elem() again to trigger refcount decrement.
7. Probe-read the refcount and verify it is *1*.
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
.../bpf/prog_tests/refcounted_kptr.c | 134 +++++++++++++++++-
.../selftests/bpf/progs/refcounted_kptr.c | 129 +++++++++++++++++
2 files changed, 262 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c b/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c
index d6bd5e16e6372..0ec91ff914af7 100644
--- a/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c
+++ b/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c
@@ -3,7 +3,7 @@
#include <test_progs.h>
#include <network_helpers.h>
-
+#include "cgroup_helpers.h"
#include "refcounted_kptr.skel.h"
#include "refcounted_kptr_fail.skel.h"
@@ -44,3 +44,135 @@ void test_refcounted_kptr_wrong_owner(void)
ASSERT_OK(opts.retval, "rbtree_wrong_owner_remove_fail_a2 retval");
refcounted_kptr__destroy(skel);
}
+
+static void test_refcnt_leak(struct refcounted_kptr *skel, int key, void *values, size_t values_sz,
+ u64 flags, struct bpf_map *map, struct bpf_program *prog_leak,
+ struct bpf_program *prog_check, struct bpf_test_run_opts *opts)
+{
+ int ret, fd;
+
+ ret = bpf_map__update_elem(map, &key, sizeof(key), values, values_sz, flags);
+ if (!ASSERT_OK(ret, "bpf_map__update_elem init"))
+ return;
+
+ fd = bpf_program__fd(prog_leak);
+ ret = bpf_prog_test_run_opts(fd, opts);
+ if (!ASSERT_OK(ret, "bpf_prog_test_run_opts"))
+ return;
+ if (!ASSERT_EQ(skel->bss->kptr_refcount, 2, "refcount"))
+ return;
+
+ ret = bpf_map__update_elem(map, &key, sizeof(key), values, values_sz, flags);
+ if (!ASSERT_OK(ret, "bpf_map__update_elem dec refcount"))
+ return;
+
+ fd = bpf_program__fd(prog_check);
+ ret = bpf_prog_test_run_opts(fd, opts);
+ ASSERT_OK(ret, "bpf_prog_test_run_opts");
+ ASSERT_EQ(skel->bss->kptr_refcount, 1, "refcount");
+}
+
+static void test_percpu_hash_refcount_leak(void)
+{
+ struct refcounted_kptr *skel;
+ size_t values_sz;
+ u64 *values;
+ int cpu_nr;
+ LIBBPF_OPTS(bpf_test_run_opts, opts,
+ .data_in = &pkt_v4,
+ .data_size_in = sizeof(pkt_v4),
+ .repeat = 1,
+ );
+
+ cpu_nr = libbpf_num_possible_cpus();
+ if (!ASSERT_GT(cpu_nr, 0, "libbpf_num_possible_cpus"))
+ return;
+
+ values = calloc(cpu_nr, sizeof(u64));
+ if (!ASSERT_OK_PTR(values, "calloc values"))
+ return;
+
+ skel = refcounted_kptr__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "refcounted_kptr__open_and_load")) {
+ free(values);
+ return;
+ }
+
+ values_sz = cpu_nr * sizeof(u64);
+ memset(values, 0, values_sz);
+
+ test_refcnt_leak(skel, 0, values, values_sz, 0, skel->maps.pcpu_hash,
+ skel->progs.pcpu_hash_refcount_leak,
+ skel->progs.check_pcpu_hash_refcount, &opts);
+
+ refcounted_kptr__destroy(skel);
+ free(values);
+}
+
+struct lock_map_value {
+ u64 kptr;
+ struct bpf_spin_lock lock;
+ int value;
+};
+
+static void test_hash_lock_refcount_leak(void)
+{
+ struct lock_map_value value = {};
+ struct refcounted_kptr *skel;
+ LIBBPF_OPTS(bpf_test_run_opts, opts,
+ .data_in = &pkt_v4,
+ .data_size_in = sizeof(pkt_v4),
+ .repeat = 1,
+ );
+
+ skel = refcounted_kptr__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "refcounted_kptr__open_and_load"))
+ return;
+
+ test_refcnt_leak(skel, 0, &value, sizeof(value), BPF_F_LOCK, skel->maps.lock_hash,
+ skel->progs.hash_lock_refcount_leak,
+ skel->progs.check_hash_lock_refcount, &opts);
+
+ refcounted_kptr__destroy(skel);
+}
+
+static void test_cgroup_storage_lock_refcount_leak(void)
+{
+ struct lock_map_value value = {};
+ struct refcounted_kptr *skel;
+ int cgroup, err;
+ LIBBPF_OPTS(bpf_test_run_opts, opts);
+
+ err = setup_cgroup_environment();
+ if (!ASSERT_OK(err, "setup_cgroup_environment"))
+ return;
+
+ cgroup = get_root_cgroup();
+ if (!ASSERT_GE(cgroup, 0, "get_root_cgroup")) {
+ cleanup_cgroup_environment();
+ return;
+ }
+
+ skel = refcounted_kptr__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "refcounted_kptr__open_and_load"))
+ goto out;
+
+ test_refcnt_leak(skel, cgroup, &value, sizeof(value), BPF_F_LOCK, skel->maps.cgrp_strg,
+ skel->progs.cgroup_storage_lock_refcount_leak,
+ skel->progs.check_cgroup_storage_lock_refcount, &opts);
+
+ refcounted_kptr__destroy(skel);
+out:
+ close(cgroup);
+ cleanup_cgroup_environment();
+}
+
+void test_kptr_refcount_leak(void)
+{
+ if (test__start_subtest("percpu_hash_refcount_leak"))
+ test_percpu_hash_refcount_leak();
+ if (test__start_subtest("hash_lock_refcount_leak"))
+ test_hash_lock_refcount_leak();
+ if (test__start_subtest("cgroup_storage_lock_refcount_leak"))
+ test_cgroup_storage_lock_refcount_leak();
+}
diff --git a/tools/testing/selftests/bpf/progs/refcounted_kptr.c b/tools/testing/selftests/bpf/progs/refcounted_kptr.c
index 893a4fdb4b6e9..101ba630d93e8 100644
--- a/tools/testing/selftests/bpf/progs/refcounted_kptr.c
+++ b/tools/testing/selftests/bpf/progs/refcounted_kptr.c
@@ -568,4 +568,133 @@ int BPF_PROG(rbtree_sleepable_rcu_no_explicit_rcu_lock,
return 0;
}
+private(kptr_ref) u64 ref;
+u32 kptr_refcount;
+
+static int probe_read_refcount(void)
+{
+ bpf_probe_read_kernel(&kptr_refcount, sizeof(kptr_refcount), (void *) ref);
+ return 0;
+}
+
+static int __insert_in_list(struct bpf_list_head *head, struct bpf_spin_lock *lock,
+ struct node_data __kptr **node)
+{
+ struct node_data *n, *m;
+
+ n = bpf_obj_new(typeof(*n));
+ if (!n)
+ return 0;
+
+ m = bpf_refcount_acquire(n);
+ n = bpf_kptr_xchg(node, n);
+ if (n) {
+ bpf_obj_drop(n);
+ bpf_obj_drop(m);
+ return 0;
+ }
+
+ bpf_spin_lock(lock);
+ bpf_list_push_front(head, &m->l);
+ ref = (u64)(void *) &m->ref;
+ bpf_spin_unlock(lock);
+ return probe_read_refcount();
+}
+
+static void *__lookup_map(void *map)
+{
+ int key = 0;
+
+ return bpf_map_lookup_elem(map, &key);
+}
+
+struct {
+ __uint(type, BPF_MAP_TYPE_PERCPU_HASH);
+ __type(key, int);
+ __type(value, struct map_value);
+ __uint(max_entries, 1);
+} pcpu_hash SEC(".maps");
+
+SEC("tc")
+int pcpu_hash_refcount_leak(void *ctx)
+{
+ struct map_value *v;
+
+ v = __lookup_map(&pcpu_hash);
+ if (!v)
+ return 0;
+
+ return __insert_in_list(&head, &lock, &v->node);
+}
+
+SEC("tc")
+int check_pcpu_hash_refcount(void *ctx)
+{
+ return probe_read_refcount();
+}
+
+struct lock_map_value {
+ struct node_data __kptr *node;
+ struct bpf_spin_lock lock;
+ int value;
+};
+
+struct {
+ __uint(type, BPF_MAP_TYPE_HASH);
+ __type(key, int);
+ __type(value, struct lock_map_value);
+ __uint(max_entries, 1);
+} lock_hash SEC(".maps");
+
+SEC("tc")
+int hash_lock_refcount_leak(void *ctx)
+{
+ struct lock_map_value *v;
+
+ v = __lookup_map(&lock_hash);
+ if (!v)
+ return 0;
+
+ bpf_spin_lock(&v->lock);
+ v->value = 42;
+ bpf_spin_unlock(&v->lock);
+ return __insert_in_list(&head, &lock, &v->node);
+}
+
+SEC("tc")
+int check_hash_lock_refcount(void *ctx)
+{
+ return probe_read_refcount();
+}
+
+struct {
+ __uint(type, BPF_MAP_TYPE_CGRP_STORAGE);
+ __uint(map_flags, BPF_F_NO_PREALLOC);
+ __type(key, int);
+ __type(value, struct lock_map_value);
+} cgrp_strg SEC(".maps");
+
+SEC("syscall")
+int BPF_PROG(cgroup_storage_lock_refcount_leak)
+{
+ struct lock_map_value *v;
+ struct task_struct *task;
+
+ task = bpf_get_current_task_btf();
+ bpf_rcu_read_lock();
+ v = bpf_cgrp_storage_get(&cgrp_strg, task->cgroups->dfl_cgrp, 0,
+ BPF_LOCAL_STORAGE_GET_F_CREATE);
+ bpf_rcu_read_unlock();
+ if (!v)
+ return 0;
+
+ return __insert_in_list(&head, &lock, &v->node);
+}
+
+SEC("syscall")
+int BPF_PROG(check_cgroup_storage_lock_refcount)
+{
+ return probe_read_refcount();
+}
+
char _license[] SEC("license") = "GPL";
--
2.51.1
On 10/30/25 8:24 AM, Leon Hwang wrote:
> Add tests to verify that updating hash and local storage maps decrements
> refcount when BPF_KPTR_REF objects are involved.
>
> The tests perform the following steps:
>
> 1. Call update_elem() to insert an initial value.
> 2. Use bpf_refcount_acquire() to increment the refcount.
> 3. Store the node pointer in the map value.
> 4. Add the node to a linked list.
> 5. Probe-read the refcount and verify it is *2*.
> 6. Call update_elem() again to trigger refcount decrement.
> 7. Probe-read the refcount and verify it is *1*.
>
> Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
I applied this patch only (i.e., not including patches 1/2/3) to master
branch and do bpf selftest and all tests succeeded.
[root@arch-fb-vm1 bpf]# ./test_progs -t refcounted_kptr
#294/1 refcounted_kptr/insert_read_both: remove from tree + list:OK
...
#294/18 refcounted_kptr/pcpu_hash_refcount_leak:OK
#294/19 refcounted_kptr/check_pcpu_hash_refcount:OK
#294/20 refcounted_kptr/hash_lock_refcount_leak:OK
#294/21 refcounted_kptr/check_hash_lock_refcount:OK
#294/22 refcounted_kptr/rbtree_sleepable_rcu:OK
#294/23 refcounted_kptr/rbtree_sleepable_rcu_no_explicit_rcu_lock:OK
#294/24 refcounted_kptr/cgroup_storage_lock_refcount_leak:OK
#294/25 refcounted_kptr/check_cgroup_storage_lock_refcount:OK
...
Did I miss anything?
> ---
> .../bpf/prog_tests/refcounted_kptr.c | 134 +++++++++++++++++-
> .../selftests/bpf/progs/refcounted_kptr.c | 129 +++++++++++++++++
> 2 files changed, 262 insertions(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c b/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c
> index d6bd5e16e6372..0ec91ff914af7 100644
> --- a/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c
> +++ b/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c
> @@ -3,7 +3,7 @@
>
> #include <test_progs.h>
> #include <network_helpers.h>
> -
> +#include "cgroup_helpers.h"
> #include "refcounted_kptr.skel.h"
> #include "refcounted_kptr_fail.skel.h"
>
> @@ -44,3 +44,135 @@ void test_refcounted_kptr_wrong_owner(void)
> ASSERT_OK(opts.retval, "rbtree_wrong_owner_remove_fail_a2 retval");
> refcounted_kptr__destroy(skel);
> }
> +
> +static void test_refcnt_leak(struct refcounted_kptr *skel, int key, void *values, size_t values_sz,
> + u64 flags, struct bpf_map *map, struct bpf_program *prog_leak,
> + struct bpf_program *prog_check, struct bpf_test_run_opts *opts)
> +{
> + int ret, fd;
> +
> + ret = bpf_map__update_elem(map, &key, sizeof(key), values, values_sz, flags);
> + if (!ASSERT_OK(ret, "bpf_map__update_elem init"))
> + return;
> +
> + fd = bpf_program__fd(prog_leak);
> + ret = bpf_prog_test_run_opts(fd, opts);
> + if (!ASSERT_OK(ret, "bpf_prog_test_run_opts"))
> + return;
> + if (!ASSERT_EQ(skel->bss->kptr_refcount, 2, "refcount"))
> + return;
> +
> + ret = bpf_map__update_elem(map, &key, sizeof(key), values, values_sz, flags);
> + if (!ASSERT_OK(ret, "bpf_map__update_elem dec refcount"))
> + return;
> +
> + fd = bpf_program__fd(prog_check);
> + ret = bpf_prog_test_run_opts(fd, opts);
> + ASSERT_OK(ret, "bpf_prog_test_run_opts");
> + ASSERT_EQ(skel->bss->kptr_refcount, 1, "refcount");
> +}
> +
[...]
On 5/11/25 01:30, Yonghong Song wrote: > > > On 10/30/25 8:24 AM, Leon Hwang wrote: >> Add tests to verify that updating hash and local storage maps decrements >> refcount when BPF_KPTR_REF objects are involved. >> >> The tests perform the following steps: >> >> 1. Call update_elem() to insert an initial value. >> 2. Use bpf_refcount_acquire() to increment the refcount. >> 3. Store the node pointer in the map value. >> 4. Add the node to a linked list. >> 5. Probe-read the refcount and verify it is *2*. >> 6. Call update_elem() again to trigger refcount decrement. >> 7. Probe-read the refcount and verify it is *1*. >> >> Signed-off-by: Leon Hwang <leon.hwang@linux.dev> > > I applied this patch only (i.e., not including patches 1/2/3) to master > branch and do bpf selftest and all tests succeeded. > > [root@arch-fb-vm1 bpf]# ./test_progs -t refcounted_kptr > #294/1 refcounted_kptr/insert_read_both: remove from tree + list:OK > ... > #294/18 refcounted_kptr/pcpu_hash_refcount_leak:OK > #294/19 refcounted_kptr/check_pcpu_hash_refcount:OK > #294/20 refcounted_kptr/hash_lock_refcount_leak:OK > #294/21 refcounted_kptr/check_hash_lock_refcount:OK > #294/22 refcounted_kptr/rbtree_sleepable_rcu:OK > #294/23 refcounted_kptr/rbtree_sleepable_rcu_no_explicit_rcu_lock:OK > #294/24 refcounted_kptr/cgroup_storage_lock_refcount_leak:OK > #294/25 refcounted_kptr/check_cgroup_storage_lock_refcount:OK > ... > > Did I miss anything? > Oops. You should run: ./test_progs -t kptr_refcount The results are as follows: test_percpu_hash_refcount_leak:PASS:libbpf_num_possible_cpus 0 nsec test_percpu_hash_refcount_leak:PASS:calloc values 0 nsec test_percpu_hash_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:PASS:refcount 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 #158/1 kptr_refcount_leak/percpu_hash_refcount_leak:FAIL test_hash_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:PASS:refcount 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 #158/2 kptr_refcount_leak/hash_lock_refcount_leak:FAIL test_cgroup_storage_lock_refcount_leak:PASS:setup_cgroup_environment 0 nsec test_cgroup_storage_lock_refcount_leak:PASS:get_root_cgroup 0 nsec test_cgroup_storage_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:PASS:refcount 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 #158/3 kptr_refcount_leak/cgroup_storage_lock_refcount_leak:FAIL #158 kptr_refcount_leak:FAIL All error logs: test_percpu_hash_refcount_leak:PASS:libbpf_num_possible_cpus 0 nsec test_percpu_hash_refcount_leak:PASS:calloc values 0 nsec test_percpu_hash_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:PASS:refcount 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 #158/1 kptr_refcount_leak/percpu_hash_refcount_leak:FAIL test_hash_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:PASS:refcount 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 #158/2 kptr_refcount_leak/hash_lock_refcount_leak:FAIL test_cgroup_storage_lock_refcount_leak:PASS:setup_cgroup_environment 0 nsec test_cgroup_storage_lock_refcount_leak:PASS:get_root_cgroup 0 nsec test_cgroup_storage_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:PASS:refcount 0 nsec test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 #158/3 kptr_refcount_leak/cgroup_storage_lock_refcount_leak:FAIL #158 kptr_refcount_leak:FAIL Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED All three tests failed because the refcount remained 2 instead of decreasing to 1 after the second update_elem() call. The CI result [1] also demonstrates this issue. Sorry for the misleading test name earlier. Links: [1] https://github.com/kernel-patches/bpf/pull/10203 Thanks, Leon [...]
On 11/4/25 6:14 PM, Leon Hwang wrote: > > On 5/11/25 01:30, Yonghong Song wrote: >> >> On 10/30/25 8:24 AM, Leon Hwang wrote: >>> Add tests to verify that updating hash and local storage maps decrements >>> refcount when BPF_KPTR_REF objects are involved. >>> >>> The tests perform the following steps: >>> >>> 1. Call update_elem() to insert an initial value. >>> 2. Use bpf_refcount_acquire() to increment the refcount. >>> 3. Store the node pointer in the map value. >>> 4. Add the node to a linked list. >>> 5. Probe-read the refcount and verify it is *2*. >>> 6. Call update_elem() again to trigger refcount decrement. >>> 7. Probe-read the refcount and verify it is *1*. >>> >>> Signed-off-by: Leon Hwang <leon.hwang@linux.dev> >> I applied this patch only (i.e., not including patches 1/2/3) to master >> branch and do bpf selftest and all tests succeeded. >> >> [root@arch-fb-vm1 bpf]# ./test_progs -t refcounted_kptr >> #294/1 refcounted_kptr/insert_read_both: remove from tree + list:OK >> ... >> #294/18 refcounted_kptr/pcpu_hash_refcount_leak:OK >> #294/19 refcounted_kptr/check_pcpu_hash_refcount:OK >> #294/20 refcounted_kptr/hash_lock_refcount_leak:OK >> #294/21 refcounted_kptr/check_hash_lock_refcount:OK >> #294/22 refcounted_kptr/rbtree_sleepable_rcu:OK >> #294/23 refcounted_kptr/rbtree_sleepable_rcu_no_explicit_rcu_lock:OK >> #294/24 refcounted_kptr/cgroup_storage_lock_refcount_leak:OK >> #294/25 refcounted_kptr/check_cgroup_storage_lock_refcount:OK >> ... >> >> Did I miss anything? >> > Oops. > > You should run: > ./test_progs -t kptr_refcount > > The results are as follows: > > test_percpu_hash_refcount_leak:PASS:libbpf_num_possible_cpus 0 nsec > test_percpu_hash_refcount_leak:PASS:calloc values 0 nsec > test_percpu_hash_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec > test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec > test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec > test_refcnt_leak:PASS:refcount 0 nsec > test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec > test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec > test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 > #158/1 kptr_refcount_leak/percpu_hash_refcount_leak:FAIL > test_hash_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec > test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec > test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec > test_refcnt_leak:PASS:refcount 0 nsec > test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec > test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec > test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 > #158/2 kptr_refcount_leak/hash_lock_refcount_leak:FAIL > test_cgroup_storage_lock_refcount_leak:PASS:setup_cgroup_environment 0 nsec > test_cgroup_storage_lock_refcount_leak:PASS:get_root_cgroup 0 nsec > test_cgroup_storage_lock_refcount_leak:PASS:refcounted_kptr__open_and_load > 0 nsec > test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec > test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec > test_refcnt_leak:PASS:refcount 0 nsec > test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec > test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec > test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 > #158/3 kptr_refcount_leak/cgroup_storage_lock_refcount_leak:FAIL > #158 kptr_refcount_leak:FAIL > > All error logs: > test_percpu_hash_refcount_leak:PASS:libbpf_num_possible_cpus 0 nsec > test_percpu_hash_refcount_leak:PASS:calloc values 0 nsec > test_percpu_hash_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec > test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec > test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec > test_refcnt_leak:PASS:refcount 0 nsec > test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec > test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec > test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 > #158/1 kptr_refcount_leak/percpu_hash_refcount_leak:FAIL > test_hash_lock_refcount_leak:PASS:refcounted_kptr__open_and_load 0 nsec > test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec > test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec > test_refcnt_leak:PASS:refcount 0 nsec > test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec > test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec > test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 > #158/2 kptr_refcount_leak/hash_lock_refcount_leak:FAIL > test_cgroup_storage_lock_refcount_leak:PASS:setup_cgroup_environment 0 nsec > test_cgroup_storage_lock_refcount_leak:PASS:get_root_cgroup 0 nsec > test_cgroup_storage_lock_refcount_leak:PASS:refcounted_kptr__open_and_load > 0 nsec > test_refcnt_leak:PASS:bpf_map__update_elem init 0 nsec > test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec > test_refcnt_leak:PASS:refcount 0 nsec > test_refcnt_leak:PASS:bpf_map__update_elem dec refcount 0 nsec > test_refcnt_leak:PASS:bpf_prog_test_run_opts 0 nsec > test_refcnt_leak:FAIL:refcount unexpected refcount: actual 2 != expected 1 > #158/3 kptr_refcount_leak/cgroup_storage_lock_refcount_leak:FAIL > #158 kptr_refcount_leak:FAIL > Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED > > All three tests failed because the refcount remained 2 instead of > decreasing to 1 after the second update_elem() call. > > The CI result [1] also demonstrates this issue. > > Sorry for the misleading test name earlier. Sorry. It is my fault. Indeed, with patches 1-3, the tests indeed failed. I obviously looked at the wrong selftest. > > Links: > [1] https://github.com/kernel-patches/bpf/pull/10203 > > Thanks, > Leon > > [...] >
© 2016 - 2026 Red Hat, Inc.