On 8/31/26 4:01 AM, Jiayuan Chen wrote:
> Create a hash and an rhash map with btf_key_type_id == 0 and expect
> bpf_map_create() to fail with -EINVAL; a positive control with a real
> key type confirms the rejection is about the key-less BTF. On an unfixed
> kernel the map is created, and the test pins and reads it back to walk
> the bpffs dump path, which reproduces the btf_type_show() NULL-deref - so
> running it on an unfixed kernel oopses the reading task (and panics it
> under panic_on_oops).
>
> Signed-off-by: Jiayuan Chen <[email protected]>
> ---
> .../bpf/prog_tests/btf_map_keyless.c | 82 +++++++++++++++++++
> 1 file changed, 82 insertions(+)
> create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_map_keyless.c
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/btf_map_keyless.c
> b/tools/testing/selftests/bpf/prog_tests/btf_map_keyless.c
> new file mode 100644
> index 000000000000..a7d037f57a7e
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/btf_map_keyless.c
> @@ -0,0 +1,82 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <test_progs.h>
> +#include <bpf/btf.h>
> +
> +/*
> + * A hash map with a key-less BTF (btf_key_type_id == 0) used to NULL-deref
> in
> + * btf_type_show() when dumped via bpffs.
> + * A fixed kernel rejects such a map at creation; on an unfixed kernel the
> + * pin-and-read below deliberately walks that bpffs dump path, so it doubles
> + * as a reproducer: it oopses an unfixed kernel (and panics it under
> + * panic_on_oops).
> + */
> +static void check_keyless(int map_type, __u32 map_flags, int btf_fd, int
> val_id)
> +{
> + LIBBPF_OPTS(bpf_map_create_opts, opts);
> + const char *path = "/sys/fs/bpf/keyless_map";
> + __u32 key = 1, val = 0x41424344;
> + char buf[256];
> + int map_fd;
> + FILE *f;
> +
> + opts.map_flags = map_flags;
> + opts.btf_fd = btf_fd;
> + opts.btf_value_type_id = val_id;
> +
> + /*
> + * Positive control: the same map with a real key type must be accepted,
> + * so the -EINVAL below is about the key-less BTF and not some unrelated
> + * rejection (e.g. an unknown map type).
> + */
> + opts.btf_key_type_id = val_id;
> + map_fd = bpf_map_create(map_type, "keyed_map", 4, 4, 8, &opts);
> + if (!ASSERT_GE(map_fd, 0, "keyed create is accepted"))
> + return;
> + close(map_fd);
> +
> + /* A key-less BTF must be rejected. */
> + opts.btf_key_type_id = 0;
> + map_fd = bpf_map_create(map_type, "keyless_map", 4, 4, 8, &opts);
> +
> + if (map_fd >= 0) {
> + /* Unfixed kernel: reproduce the oops via the bpffs dump path.
> */
> + (void)bpf_map_update_elem(map_fd, &key, &val, 0);
> + if (bpf_obj_pin(map_fd, path) == 0) {
> + f = fopen(path, "r");
> + if (f) {
> + while (fgets(buf, sizeof(buf), f))
> + ;
> + fclose(f);
> + }
> + unlink(path);
> + }
> + close(map_fd);
> + }
The whole `if (map_fd >= 0) { ... }` block can be dropped.
If the map has been accepted (0 instead of -EINVAL), it already catches the bug.
It's unnecessary to reproduce the NULL ptr splat.
pw-bot: cr
Also, I think it would be useful to refactor and extend existing
selftests that were added for the features (for example an old
prog_tests/snprintf_btf.c), instead of adding a new test program for
every regression case. Not a blocker, but an effort in that direction
would be much appreciated.
Thanks!
> +
> + ASSERT_EQ(map_fd, -EINVAL, "key-less create is rejected");
> +}
> +
> [...]
