create_cpumask() can return NULL, but test_alloc_double_release does
not check its result before releasing it. The expected NULL-pointer
diagnostic allows the test to pass when the first release is rejected,
without checking the second release at all. Removing the second call
still produces the same expected rejection.
Return when creation fails and expect the release-ownership diagnostic.
This makes the verifier accept the first release and reject the second
use of the invalidated reference.
Verified that the guarded single-release control is accepted and the
guarded double-release program is rejected at its second release. All
36 cpumask subtests pass on the matching kernel.
Fixes: 7b6abcfa15cd ("selftests/bpf: Add selftest suite for cpumask kfuncs")
Assisted-by: LLM
Signed-off-by: Tianyi Chen <[email protected]>
---
tools/testing/selftests/bpf/progs/cpumask_failure.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/progs/cpumask_failure.c
b/tools/testing/selftests/bpf/progs/cpumask_failure.c
index 4628feb53d8..e98493bd575 100644
--- a/tools/testing/selftests/bpf/progs/cpumask_failure.c
+++ b/tools/testing/selftests/bpf/progs/cpumask_failure.c
@@ -45,12 +45,14 @@ int BPF_PROG(test_alloc_no_release, struct task_struct
*task, u64 clone_flags)
}
SEC("tp_btf/task_newtask")
-__failure __msg("NULL pointer passed to trusted R1")
+__failure __msg("release kfunc bpf_cpumask_release expects referenced
PTR_TO_BTF_ID passed to R1")
int BPF_PROG(test_alloc_double_release, struct task_struct *task, u64
clone_flags)
{
struct bpf_cpumask *cpumask;
cpumask = create_cpumask();
+ if (!cpumask)
+ return 0;
/* cpumask is released twice. */
bpf_cpumask_release(cpumask);
--
2.55.0
