Re: [PATCH bpf-next v3 7/9] selftests/bpf: Add struct_ops __arena and __arena_nullable argument tests

Thank you for your contribution! Sashiko AI review found 1 potential issue(=
s) to consider:
- [Medium] Unconditional dereference of global pointer st_ops3 in new kfunc=
s can lead to kernel panic if called before struct_ops attachment.
--

--- Patch [7]: [PATCH bpf-next v3 7/9] selftests/bpf: Add struct_ops __aren=
a and __arena_nullable argument tests ---
commit f599951dcb563bef61136071f8ea610da5c68910
Author: Tejun Heo <[email protected]>

selftests/bpf: Add struct_ops __arena and __arena_nullable argument tests

This commit adds test_arena and test_arena_nullable members to the
bpf_testmod_ops3 struct to test arena-tagged arguments and kfuncs that forw=
ard
caller-provided pointers. It ensures that the kfuncs correctly receive a ke=
rnel
arena address and the trampoline converts it back to an arena pointer.=20

> diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools=
/testing/selftests/bpf/test_kmods/bpf_testmod.c
> index f4cd1ad254a5a..396e5b467855b 100644
> --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
[ ... ]
> @@ -418,6 +430,16 @@ __bpf_kfunc void bpf_testmod_ops3_call_test_2(void)
>  	st_ops3->test_2();
>  }
> =20
> +__bpf_kfunc int bpf_testmod_ops3_call_test_arena(u64 *ptr__arena)
> +{
> +	return st_ops3->test_arena(ptr__arena);

[Severity: Medium]
Can this unconditionally dereference st_ops3 without synchronization?

If a BPF program calls bpf_testmod_ops3_call_test_arena() before the
bpf_testmod_ops3 struct_ops map is attached, or after it has been detached,
st_ops3 would be NULL. Could this lead to a kernel panic?

> +}
> +
> +__bpf_kfunc int bpf_testmod_ops3_call_test_arena_nullable(u64 *ptr__aren=
a_nullable)
> +{
> +	return st_ops3->test_arena_nullable(ptr__arena_nullable);

[Severity: Medium]
Similarly, does this have the same risk of a NULL pointer dereference if
st_ops3 is NULL when bpf_testmod_ops3_call_test_arena_nullable() is called?

> +}
> +

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260803125115.2264=
[email protected]?part=3D7