From: bot+bpf-ci@kernel.org
To: hui.zhu@linux.dev, akpm@linux-foundation.org, hannes@cmpxchg.org,
mhocko@kernel.org, roman.gushchin@linux.dev,
shakeel.butt@linux.dev, muchun.song@linux.dev, ast@kernel.org,
daniel@iogearbox.net, andrii@kernel.org, martin.lau@linux.dev,
eddyz87@gmail.com, song@kernel.org, yonghong.song@linux.dev,
john.fastabend@gmail.com, kpsingh@kernel.org, sdf@fomichev.me,
haoluo@google.com, jolsa@kernel.org, shuah@kernel.org,
peterz@infradead.org, ojeda@kernel.org, nathan@kernel.org,
kees@kernel.org, tj@kernel.org, jeffxu@chromium.org,
mkoutny@suse.com, kernel@jfarr.cc, brauner@kernel.org,
rdunlap@infradead.org, brgerst@gmail.com, masahiroy@kernel.org,
davem@davemloft.net, kuba@kernel.org, hawk@kernel.org,
inwardvessel@gmail.com, willemb@google.com,
kerneljasonxing@gmail.com, paul.chaignon@gmail.com,
a.s.protopopov@gmail.com, ameryhung@gmail.com,
chenridong@huaweicloud.com, lance.yang@linux.dev,
jiayuan.chen@linux.dev, linux-kernel@vger.kernel.org,
linux-mm@kvack.org, cgroups@vger.kernel.org, bpf@vger.kernel.org,
netdev@vger.kernel.org, linu@kvack.org,
x-kselftest@vger.kernel.org
Cc: zhuhui@kylinos.cn,geliang@kernel.org,ast@kernel.org,andrii@kernel.org,daniel@iogearbox.net,martin.lau@kernel.org,eddyz87@gmail.com,yonghong.song@linux.dev,clm@meta.com,ihor.solodrai@linux.dev
Subject: Re: [RFC PATCH bpf-next v6 11/12] selftests/bpf: Add test for memcg_bpf_ops hierarchies
Date: Wed, 4 Feb 2026 09:28:34 +0000 (UTC) [thread overview]
Message-ID: <958ccd923342ddd02e9122381d51319cb125ec51d601bb6fcad57531a2f5ef57@mail.kernel.org> (raw)
In-Reply-To: <031afcd7c16e97f1f3c0d4a8a526a9eee2ad23fd.1770194182.git.zhuhui@kylinos.cn>
[-- Attachment #1: Type: text/plain, Size: 2129 bytes --]
> diff --git a/tools/testing/selftests/bpf/prog_tests/memcg_ops.c b/tools/testing/selftests/bpf/prog_tests/memcg_ops.c
> index 8c787439f..378ee3b3b 100644
> --- a/tools/testing/selftests/bpf/prog_tests/memcg_ops.c
> +++ b/tools/testing/selftests/bpf/prog_tests/memcg_ops.c
[ ... ]
> +void test_memcg_ops_hierarchies(void)
> +{
> + int ret, first = -1, second = -1, third = -1;
> + struct memcg_ops *skel = NULL;
[ ... ]
> +cleanup:
> + bpf_link__destroy(link1);
> + bpf_link__destroy(link2);
> + bpf_link__destroy(link3);
> + memcg_ops__detach(skel);
> + memcg_ops__destroy(skel);
Can this crash if skel is NULL? Unlike the other tests in this file
which guard these calls with if (skel), this cleanup path calls
memcg_ops__detach() unconditionally. If any of the earlier goto cleanup
paths are taken before memcg_ops__open_and_load() succeeds, skel remains
NULL.
The generated skeleton __detach() function does not have a NULL check:
static inline void
%1$s__detach(struct %1$s *obj)
{
bpf_object__detach_skeleton(obj->skeleton);
}
This would dereference NULL when accessing obj->skeleton.
For comparison, test_memcg_ops_over_high(), test_memcg_ops_below_low_over_high(),
and test_memcg_ops_below_min_over_high() in the same file all use:
if (skel) {
memcg_ops__detach(skel);
memcg_ops__destroy(skel);
}
> + close(first);
> + close(second);
> + close(third);
> + cleanup_cgroup_environment();
> +}
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21665371660
AI-authorship-score: low
AI-authorship-explanation: The code follows consistent patterns with other tests in the file and uses standard BPF selftest conventions, suggesting human authorship with good domain knowledge.
issues-found: 1
issue-severity-score: low
issue-severity-explanation: NULL pointer dereference crash in selftest cleanup path when cgroup setup fails, affecting test reliability but not production kernel code.
next prev parent reply other threads:[~2026-02-04 9:28 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-04 8:56 [RFC PATCH bpf-next v6 00/12] mm: memcontrol: Add BPF hooks for memory controller Hui Zhu
2026-02-04 8:56 ` [RFC PATCH bpf-next v6 01/12] bpf: move bpf_struct_ops_link into bpf.h Hui Zhu
2026-02-04 8:56 ` [RFC PATCH bpf-next v6 02/12] bpf: initial support for attaching struct ops to cgroups Hui Zhu
2026-02-04 8:56 ` [RFC PATCH bpf-next v6 03/12] bpf: mark struct oom_control's memcg field as TRUSTED_OR_NULL Hui Zhu
2026-02-04 8:56 ` [RFC PATCH bpf-next v6 04/12] mm: define mem_cgroup_get_from_ino() outside of CONFIG_SHRINKER_DEBUG Hui Zhu
2026-02-04 8:56 ` [RFC PATCH bpf-next v6 05/12] libbpf: introduce bpf_map__attach_struct_ops_opts() Hui Zhu
2026-02-04 9:28 ` bot+bpf-ci
2026-02-04 8:56 ` [RFC PATCH bpf-next v6 06/12] bpf: Pass flags in bpf_link_create for struct_ops Hui Zhu
2026-02-04 9:28 ` bot+bpf-ci
2026-02-04 9:00 ` [RFC PATCH bpf-next v6 07/12] libbpf: Support passing user-defined flags " Hui Zhu
2026-02-04 9:28 ` bot+bpf-ci
2026-02-04 9:00 ` [RFC PATCH bpf-next v6 08/12] mm: memcontrol: Add BPF struct_ops for memory controller Hui Zhu
2026-02-04 9:00 ` [RFC PATCH bpf-next v6 09/12] selftests/bpf: Add tests for memcg_bpf_ops Hui Zhu
2026-02-04 9:00 ` [RFC PATCH bpf-next v6 10/12] mm/bpf: Add BPF_F_ALLOW_OVERRIDE support " Hui Zhu
2026-02-04 9:00 ` [RFC PATCH bpf-next v6 11/12] selftests/bpf: Add test for memcg_bpf_ops hierarchies Hui Zhu
2026-02-04 9:28 ` bot+bpf-ci [this message]
2026-02-04 9:00 ` [RFC PATCH bpf-next v6 12/12] samples/bpf: Add memcg priority control example Hui Zhu
2026-02-04 9:28 ` bot+bpf-ci
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=958ccd923342ddd02e9122381d51319cb125ec51d601bb6fcad57531a2f5ef57@mail.kernel.org \
--to=bot+bpf-ci@kernel.org \
--cc=a.s.protopopov@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=brauner@kernel.org \
--cc=brgerst@gmail.com \
--cc=cgroups@vger.kernel.org \
--cc=chenridong@huaweicloud.com \
--cc=clm@meta.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=geliang@kernel.org \
--cc=hannes@cmpxchg.org \
--cc=haoluo@google.com \
--cc=hawk@kernel.org \
--cc=hui.zhu@linux.dev \
--cc=ihor.solodrai@linux.dev \
--cc=inwardvessel@gmail.com \
--cc=jeffxu@chromium.org \
--cc=jiayuan.chen@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kees@kernel.org \
--cc=kernel@jfarr.cc \
--cc=kerneljasonxing@gmail.com \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=lance.yang@linux.dev \
--cc=linu@kvack.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=martin.lau@kernel.org \
--cc=martin.lau@linux.dev \
--cc=masahiroy@kernel.org \
--cc=mhocko@kernel.org \
--cc=mkoutny@suse.com \
--cc=muchun.song@linux.dev \
--cc=nathan@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=ojeda@kernel.org \
--cc=paul.chaignon@gmail.com \
--cc=peterz@infradead.org \
--cc=rdunlap@infradead.org \
--cc=roman.gushchin@linux.dev \
--cc=sdf@fomichev.me \
--cc=shakeel.butt@linux.dev \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=tj@kernel.org \
--cc=willemb@google.com \
--cc=x-kselftest@vger.kernel.org \
--cc=yonghong.song@linux.dev \
--cc=zhuhui@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox