Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel Borkmann says:

====================
pull-request: bpf 2019-03-16

The following pull-request contains BPF updates for your *net* tree.

The main changes are:

1) Fix a umem memory leak on cleanup in AF_XDP, from Björn.

2) Fix BTF to properly resolve forward-declared enums into their corresponding
   full enum definition types during deduplication, from Andrii.

3) Fix libbpf to reject invalid flags in xsk_socket__create(), from Magnus.

4) Fix accessing invalid pointer returned from bpf_tcp_sock() and
   bpf_sk_fullsock() after bpf_sk_release() was called, from Martin.

5) Fix generation of load/store DW instructions in PPC JIT, from Naveen.

6) Various fixes in BPF helper function documentation in bpf.h UAPI header
   used to bpf-helpers(7) man page, from Quentin.

7) Fix segfault in BPF test_progs when prog loading failed, from Yonghong.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

12 files changed, 582 insertions, 129 deletions

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 3c38ac9a92a7..929c8e537a14 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -502,16 +502,6 @@ union bpf_attr {
  *      Return
  *              0 on success, or a negative error in case of failure.
  *
- * int bpf_map_push_elem(struct bpf_map *map, const void *value, u64 flags)
- *      Description
- *              Push an element *value* in *map*. *flags* is one of:
- *
- *              **BPF_EXIST**
- *              If the queue/stack is full, the oldest element is removed to
- *              make room for this.
- *      Return
- *              0 on success, or a negative error in case of failure.
- *
  * int bpf_probe_read(void *dst, u32 size, const void *src)
  *      Description
  *              For tracing programs, safely attempt to read *size* bytes from
@@ -1435,14 +1425,14 @@ union bpf_attr {
  * u64 bpf_get_socket_cookie(struct bpf_sock_addr *ctx)
  *      Description
  *              Equivalent to bpf_get_socket_cookie() helper that accepts
- *              *skb*, but gets socket from **struct bpf_sock_addr** contex.
+ *              *skb*, but gets socket from **struct bpf_sock_addr** context.
  *      Return
  *              A 8-byte long non-decreasing number.
  *
  * u64 bpf_get_socket_cookie(struct bpf_sock_ops *ctx)
  *      Description
  *              Equivalent to bpf_get_socket_cookie() helper that accepts
- *              *skb*, but gets socket from **struct bpf_sock_ops** contex.
+ *              *skb*, but gets socket from **struct bpf_sock_ops** context.
  *      Return
  *              A 8-byte long non-decreasing number.
  *
@@ -2098,52 +2088,52 @@ union bpf_attr {
  *      Return
  *              0 on success, or a negative error in case of failure.
  *
- * int bpf_rc_keydown(void *ctx, u32 protocol, u64 scancode, u32 toggle)
+ * int bpf_rc_repeat(void *ctx)
  *      Description
  *              This helper is used in programs implementing IR decoding, to
- *              report a successfully decoded key press with *scancode*,
- *              *toggle* value in the given *protocol*. The scancode will be
- *              translated to a keycode using the rc keymap, and reported as
- *              an input key down event. After a period a key up event is
- *              generated. This period can be extended by calling either
- *              **bpf_rc_keydown**\ () again with the same values, or calling
- *              **bpf_rc_repeat**\ ().
+ *              report a successfully decoded repeat key message. This delays
+ *              the generation of a key up event for previously generated
+ *              key down event.
  *
- *              Some protocols include a toggle bit, in case the button was
- *              released and pressed again between consecutive scancodes.
+ *              Some IR protocols like NEC have a special IR message for
+ *              repeating last button, for when a button is held down.
  *
  *              The *ctx* should point to the lirc sample as passed into
  *              the program.
  *
- *              The *protocol* is the decoded protocol number (see
- *              **enum rc_proto** for some predefined values).
- *
  *              This helper is only available is the kernel was compiled with
  *              the **CONFIG_BPF_LIRC_MODE2** configuration option set to
  *              "**y**".
  *      Return
  *              0
  *
- * int bpf_rc_repeat(void *ctx)
+ * int bpf_rc_keydown(void *ctx, u32 protocol, u64 scancode, u32 toggle)
  *      Description
  *              This helper is used in programs implementing IR decoding, to
- *              report a successfully decoded repeat key message. This delays
- *              the generation of a key up event for previously generated
- *              key down event.
+ *              report a successfully decoded key press with *scancode*,
+ *              *toggle* value in the given *protocol*. The scancode will be
+ *              translated to a keycode using the rc keymap, and reported as
+ *              an input key down event. After a period a key up event is
+ *              generated. This period can be extended by calling either
+ *              **bpf_rc_keydown**\ () again with the same values, or calling
+ *              **bpf_rc_repeat**\ ().
  *
- *              Some IR protocols like NEC have a special IR message for
- *              repeating last button, for when a button is held down.
+ *              Some protocols include a toggle bit, in case the button was
+ *              released and pressed again between consecutive scancodes.
  *
  *              The *ctx* should point to the lirc sample as passed into
  *              the program.
  *
+ *              The *protocol* is the decoded protocol number (see
+ *              **enum rc_proto** for some predefined values).
+ *
  *              This helper is only available is the kernel was compiled with
  *              the **CONFIG_BPF_LIRC_MODE2** configuration option set to
  *              "**y**".
  *      Return
  *              0
  *
- * uint64_t bpf_skb_cgroup_id(struct sk_buff *skb)
+ * u64 bpf_skb_cgroup_id(struct sk_buff *skb)
  *      Description
  *              Return the cgroup v2 id of the socket associated with the *skb*.
  *              This is roughly similar to the **bpf_get_cgroup_classid**\ ()
@@ -2159,30 +2149,12 @@ union bpf_attr {
  *      Return
  *              The id is returned or 0 in case the id could not be retrieved.
  *
- * u64 bpf_skb_ancestor_cgroup_id(struct sk_buff *skb, int ancestor_level)
- *      Description
- *              Return id of cgroup v2 that is ancestor of cgroup associated
- *              with the *skb* at the *ancestor_level*.  The root cgroup is at
- *              *ancestor_level* zero and each step down the hierarchy
- *              increments the level. If *ancestor_level* == level of cgroup
- *              associated with *skb*, then return value will be same as that
- *              of **bpf_skb_cgroup_id**\ ().
- *
- *              The helper is useful to implement policies based on cgroups
- *              that are upper in hierarchy than immediate cgroup associated
- *              with *skb*.
- *
- *              The format of returned id and helper limitations are same as in
- *              **bpf_skb_cgroup_id**\ ().
- *      Return
- *              The id is returned or 0 in case the id could not be retrieved.
- *
  * u64 bpf_get_current_cgroup_id(void)
  *      Return
  *              A 64-bit integer containing the current cgroup id based
  *              on the cgroup within which the current task is running.
  *
- * void* get_local_storage(void *map, u64 flags)
+ * void *bpf_get_local_storage(void *map, u64 flags)
  *      Description
  *              Get the pointer to the local storage area.
  *              The type and the size of the local storage is defined
@@ -2209,6 +2181,24 @@ union bpf_attr {
  *      Return
  *              0 on success, or a negative error in case of failure.
  *
+ * u64 bpf_skb_ancestor_cgroup_id(struct sk_buff *skb, int ancestor_level)
+ *      Description
+ *              Return id of cgroup v2 that is ancestor of cgroup associated
+ *              with the *skb* at the *ancestor_level*.  The root cgroup is at
+ *              *ancestor_level* zero and each step down the hierarchy
+ *              increments the level. If *ancestor_level* == level of cgroup
+ *              associated with *skb*, then return value will be same as that
+ *              of **bpf_skb_cgroup_id**\ ().
+ *
+ *              The helper is useful to implement policies based on cgroups
+ *              that are upper in hierarchy than immediate cgroup associated
+ *              with *skb*.
+ *
+ *              The format of returned id and helper limitations are same as in
+ *              **bpf_skb_cgroup_id**\ ().
+ *      Return
+ *              The id is returned or 0 in case the id could not be retrieved.
+ *
  * struct bpf_sock *bpf_sk_lookup_tcp(void *ctx, struct bpf_sock_tuple *tuple, u32 tuple_size, u64 netns, u64 flags)
  *      Description
  *              Look for TCP socket matching *tuple*, optionally in a child
@@ -2289,6 +2279,16 @@ union bpf_attr {
  *      Return
  *              0 on success, or a negative error in case of failure.
  *
+ * int bpf_map_push_elem(struct bpf_map *map, const void *value, u64 flags)
+ *      Description
+ *              Push an element *value* in *map*. *flags* is one of:
+ *
+ *              **BPF_EXIST**
+ *                      If the queue/stack is full, the oldest element is
+ *                      removed to make room for this.
+ *      Return
+ *              0 on success, or a negative error in case of failure.
+ *
  * int bpf_map_pop_elem(struct bpf_map *map, void *value)
  *      Description
  *              Pop an element from *map*.
@@ -2343,29 +2343,94 @@ union bpf_attr {
  *      Return
  *              0
  *
+ * int bpf_spin_lock(struct bpf_spin_lock *lock)
+ *      Description
+ *              Acquire a spinlock represented by the pointer *lock*, which is
+ *              stored as part of a value of a map. Taking the lock allows to
+ *              safely update the rest of the fields in that value. The
+ *              spinlock can (and must) later be released with a call to
+ *              **bpf_spin_unlock**\ (\ *lock*\ ).
+ *
+ *              Spinlocks in BPF programs come with a number of restrictions
+ *              and constraints:
+ *
+ *              * **bpf_spin_lock** objects are only allowed inside maps of
+ *                types **BPF_MAP_TYPE_HASH** and **BPF_MAP_TYPE_ARRAY** (this
+ *                list could be extended in the future).
+ *              * BTF description of the map is mandatory.
+ *              * The BPF program can take ONE lock at a time, since taking two
+ *                or more could cause dead locks.
+ *              * Only one **struct bpf_spin_lock** is allowed per map element.
+ *              * When the lock is taken, calls (either BPF to BPF or helpers)
+ *                are not allowed.
+ *              * The **BPF_LD_ABS** and **BPF_LD_IND** instructions are not
+ *                allowed inside a spinlock-ed region.
+ *              * The BPF program MUST call **bpf_spin_unlock**\ () to release
+ *                the lock, on all execution paths, before it returns.
+ *              * The BPF program can access **struct bpf_spin_lock** only via
+ *                the **bpf_spin_lock**\ () and **bpf_spin_unlock**\ ()
+ *                helpers. Loading or storing data into the **struct
+ *                bpf_spin_lock** *lock*\ **;** field of a map is not allowed.
+ *              * To use the **bpf_spin_lock**\ () helper, the BTF description
+ *                of the map value must be a struct and have **struct
+ *                bpf_spin_lock** *anyname*\ **;** field at the top level.
+ *                Nested lock inside another struct is not allowed.
+ *              * The **struct bpf_spin_lock** *lock* field in a map value must
+ *                be aligned on a multiple of 4 bytes in that value.
+ *              * Syscall with command **BPF_MAP_LOOKUP_ELEM** does not copy
+ *                the **bpf_spin_lock** field to user space.
+ *              * Syscall with command **BPF_MAP_UPDATE_ELEM**, or update from
+ *                a BPF program, do not update the **bpf_spin_lock** field.
+ *              * **bpf_spin_lock** cannot be on the stack or inside a
+ *                networking packet (it can only be inside of a map values).
+ *              * **bpf_spin_lock** is available to root only.
+ *              * Tracing programs and socket filter programs cannot use
+ *                **bpf_spin_lock**\ () due to insufficient preemption checks
+ *                (but this may change in the future).
+ *              * **bpf_spin_lock** is not allowed in inner maps of map-in-map.
+ *      Return
+ *              0
+ *
+ * int bpf_spin_unlock(struct bpf_spin_lock *lock)
+ *      Description
+ *              Release the *lock* previously locked by a call to
+ *              **bpf_spin_lock**\ (\ *lock*\ ).
+ *      Return
+ *              0
+ *
  * struct bpf_sock *bpf_sk_fullsock(struct bpf_sock *sk)
  *      Description
  *              This helper gets a **struct bpf_sock** pointer such
- *              that all the fields in bpf_sock can be accessed.
+ *              that all the fields in this **bpf_sock** can be accessed.
  *      Return
- *              A **struct bpf_sock** pointer on success, or NULL in
+ *              A **struct bpf_sock** pointer on success, or **NULL** in
  *              case of failure.
  *
  * struct bpf_tcp_sock *bpf_tcp_sock(struct bpf_sock *sk)
  *      Description
  *              This helper gets a **struct bpf_tcp_sock** pointer from a
  *              **struct bpf_sock** pointer.
- *
  *      Return
- *              A **struct bpf_tcp_sock** pointer on success, or NULL in
+ *              A **struct bpf_tcp_sock** pointer on success, or **NULL** in
  *              case of failure.
  *
  * int bpf_skb_ecn_set_ce(struct sk_buf *skb)
- *     Description
- *             Sets ECN of IP header to ce (congestion encountered) if
- *             current value is ect (ECN capable). Works with IPv6 and IPv4.
- *     Return
- *             1 if set, 0 if not set.
+ *      Description
+ *              Set ECN (Explicit Congestion Notification) field of IP header
+ *              to **CE** (Congestion Encountered) if current value is **ECT**
+ *              (ECN Capable Transport). Otherwise, do nothing. Works with IPv6
+ *              and IPv4.
+ *      Return
+ *              1 if the **CE** flag is set (either by the current helper call
+ *              or because it was already present), 0 if it is not set.
+ *
+ * struct bpf_sock *bpf_get_listener_sock(struct bpf_sock *sk)
+ *      Description
+ *              Return a **struct bpf_sock** pointer in **TCP_LISTEN** state.
+ *              **bpf_sk_release**\ () is unnecessary and not allowed.
+ *      Return
+ *              A **struct bpf_sock** pointer on success, or **NULL** in
+ *              case of failure.
  */
 #define __BPF_FUNC_MAPPER(FN)           \
         FN(unspec),                     \
@@ -2465,7 +2530,8 @@ union bpf_attr {
         FN(spin_unlock),                \
         FN(sk_fullsock),                \
         FN(tcp_sock),                   \
-        FN(skb_ecn_set_ce),
+        FN(skb_ecn_set_ce),             \
+        FN(get_listener_sock),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 1b8d8cdd3575..87e3020ac1bc 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -1602,16 +1602,12 @@ static bool btf_equal_int(struct btf_type *t1, struct btf_type *t2)
 /* Calculate type signature hash of ENUM. */
 static __u32 btf_hash_enum(struct btf_type *t)
 {
-        struct btf_enum *member = (struct btf_enum *)(t + 1);
-        __u32 vlen = BTF_INFO_VLEN(t->info);
-        __u32 h = btf_hash_common(t);
-        int i;
+        __u32 h;
 
-        for (i = 0; i < vlen; i++) {
-                h = hash_combine(h, member->name_off);
-                h = hash_combine(h, member->val);
-                member++;
-        }
+        /* don't hash vlen and enum members to support enum fwd resolving */
+        h = hash_combine(0, t->name_off);
+        h = hash_combine(h, t->info & ~0xffff);
+        h = hash_combine(h, t->size);
         return h;
 }
 
@@ -1637,6 +1633,22 @@ static bool btf_equal_enum(struct btf_type *t1, struct btf_type *t2)
         return true;
 }
 
+static inline bool btf_is_enum_fwd(struct btf_type *t)
+{
+        return BTF_INFO_KIND(t->info) == BTF_KIND_ENUM &&
+               BTF_INFO_VLEN(t->info) == 0;
+}
+
+static bool btf_compat_enum(struct btf_type *t1, struct btf_type *t2)
+{
+        if (!btf_is_enum_fwd(t1) && !btf_is_enum_fwd(t2))
+                return btf_equal_enum(t1, t2);
+        /* ignore vlen when comparing */
+        return t1->name_off == t2->name_off &&
+               (t1->info & ~0xffff) == (t2->info & ~0xffff) &&
+               t1->size == t2->size;
+}
+
 /*
  * Calculate type signature hash of STRUCT/UNION, ignoring referenced type IDs,
  * as referenced type IDs equivalence is established separately during type
@@ -1860,6 +1872,17 @@ static int btf_dedup_prim_type(struct btf_dedup *d, __u32 type_id)
                                 new_id = cand_node->type_id;
                                 break;
                         }
+                        if (d->opts.dont_resolve_fwds)
+                                continue;
+                        if (btf_compat_enum(t, cand)) {
+                                if (btf_is_enum_fwd(t)) {
+                                        /* resolve fwd to full enum */
+                                        new_id = cand_node->type_id;
+                                        break;
+                                }
+                                /* resolve canonical enum fwd to full enum */
+                                d->map[cand_node->type_id] = type_id;
+                        }
                 }
                 break;
 
@@ -2084,15 +2107,15 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id,
                 return fwd_kind == real_kind;
         }
 
-        if (cand_type->info != canon_type->info)
-                return 0;
-
         switch (cand_kind) {
         case BTF_KIND_INT:
                 return btf_equal_int(cand_type, canon_type);
 
         case BTF_KIND_ENUM:
-                return btf_equal_enum(cand_type, canon_type);
+                if (d->opts.dont_resolve_fwds)
+                        return btf_equal_enum(cand_type, canon_type);
+                else
+                        return btf_compat_enum(cand_type, canon_type);
 
         case BTF_KIND_FWD:
                 return btf_equal_common(cand_type, canon_type);
@@ -2103,6 +2126,8 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id,
         case BTF_KIND_PTR:
         case BTF_KIND_TYPEDEF:
         case BTF_KIND_FUNC:
+                if (cand_type->info != canon_type->info)
+                        return 0;
                 return btf_dedup_is_equiv(d, cand_type->type, canon_type->type);
 
         case BTF_KIND_ARRAY: {
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index d5b830d60601..5e977d2688da 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -835,12 +835,19 @@ static int bpf_object__elf_collect(struct bpf_object *obj, int flags)
                         obj->efile.maps_shndx = idx;
                 else if (strcmp(name, BTF_ELF_SEC) == 0) {
                         obj->btf = btf__new(data->d_buf, data->d_size);
-                        if (IS_ERR(obj->btf) || btf__load(obj->btf)) {
+                        if (IS_ERR(obj->btf)) {
                                 pr_warning("Error loading ELF section %s: %ld. Ignored and continue.\n",
                                            BTF_ELF_SEC, PTR_ERR(obj->btf));
-                                if (!IS_ERR(obj->btf))
-                                        btf__free(obj->btf);
                                 obj->btf = NULL;
+                                continue;
+                        }
+                        err = btf__load(obj->btf);
+                        if (err) {
+                                pr_warning("Error loading %s into kernel: %d. Ignored and continue.\n",
+                                           BTF_ELF_SEC, err);
+                                btf__free(obj->btf);
+                                obj->btf = NULL;
+                                err = 0;
                         }
                 } else if (strcmp(name, BTF_EXT_ELF_SEC) == 0) {
                         btf_ext_data = data;
diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c
index f98ac82c9aea..8d0078b65486 100644
--- a/tools/lib/bpf/xsk.c
+++ b/tools/lib/bpf/xsk.c
@@ -126,8 +126,8 @@ static void xsk_set_umem_config(struct xsk_umem_config *cfg,
         cfg->frame_headroom = usr_cfg->frame_headroom;
 }
 
-static void xsk_set_xdp_socket_config(struct xsk_socket_config *cfg,
-                                      const struct xsk_socket_config *usr_cfg)
+static int xsk_set_xdp_socket_config(struct xsk_socket_config *cfg,
+                                     const struct xsk_socket_config *usr_cfg)
 {
         if (!usr_cfg) {
                 cfg->rx_size = XSK_RING_CONS__DEFAULT_NUM_DESCS;
@@ -135,14 +135,19 @@ static void xsk_set_xdp_socket_config(struct xsk_socket_config *cfg,
                 cfg->libbpf_flags = 0;
                 cfg->xdp_flags = 0;
                 cfg->bind_flags = 0;
-                return;
+                return 0;
         }
 
+        if (usr_cfg->libbpf_flags & ~XSK_LIBBPF_FLAGS__INHIBIT_PROG_LOAD)
+                return -EINVAL;
+
         cfg->rx_size = usr_cfg->rx_size;
         cfg->tx_size = usr_cfg->tx_size;
         cfg->libbpf_flags = usr_cfg->libbpf_flags;
         cfg->xdp_flags = usr_cfg->xdp_flags;
         cfg->bind_flags = usr_cfg->bind_flags;
+
+        return 0;
 }
 
 int xsk_umem__create(struct xsk_umem **umem_ptr, void *umem_area, __u64 size,
@@ -557,7 +562,9 @@ int xsk_socket__create(struct xsk_socket **xsk_ptr, const char *ifname,
         }
         strncpy(xsk->ifname, ifname, IFNAMSIZ);
 
-        xsk_set_xdp_socket_config(&xsk->config, usr_config);
+        err = xsk_set_xdp_socket_config(&xsk->config, usr_config);
+        if (err)
+                goto out_socket;
 
         if (rx) {
                 err = setsockopt(xsk->fd, SOL_XDP, XDP_RX_RING,
diff --git a/tools/testing/selftests/bpf/bpf_helpers.h b/tools/testing/selftests/bpf/bpf_helpers.h
index c9433a496d54..c81fc350f7ad 100644
--- a/tools/testing/selftests/bpf/bpf_helpers.h
+++ b/tools/testing/selftests/bpf/bpf_helpers.h
@@ -180,6 +180,8 @@ static struct bpf_sock *(*bpf_sk_fullsock)(struct bpf_sock *sk) =
         (void *) BPF_FUNC_sk_fullsock;
 static struct bpf_tcp_sock *(*bpf_tcp_sock)(struct bpf_sock *sk) =
         (void *) BPF_FUNC_tcp_sock;
+static struct bpf_sock *(*bpf_get_listener_sock)(struct bpf_sock *sk) =
+        (void *) BPF_FUNC_get_listener_sock;
 static int (*bpf_skb_ecn_set_ce)(void *ctx) =
         (void *) BPF_FUNC_skb_ecn_set_ce;
 
diff --git a/tools/testing/selftests/bpf/prog_tests/map_lock.c b/tools/testing/selftests/bpf/prog_tests/map_lock.c
index 90f8a206340a..ee99368c595c 100644
--- a/tools/testing/selftests/bpf/prog_tests/map_lock.c
+++ b/tools/testing/selftests/bpf/prog_tests/map_lock.c
@@ -37,7 +37,7 @@ void test_map_lock(void)
         const char *file = "./test_map_lock.o";
         int prog_fd, map_fd[2], vars[17] = {};
         pthread_t thread_id[6];
-        struct bpf_object *obj;
+        struct bpf_object *obj = NULL;
         int err = 0, key = 0, i;
         void *ret;
 
diff --git a/tools/testing/selftests/bpf/prog_tests/spinlock.c b/tools/testing/selftests/bpf/prog_tests/spinlock.c
index 9a573a9675d7..114ebe6a438e 100644
--- a/tools/testing/selftests/bpf/prog_tests/spinlock.c
+++ b/tools/testing/selftests/bpf/prog_tests/spinlock.c
@@ -5,7 +5,7 @@ void test_spinlock(void)
 {
         const char *file = "./test_spin_lock.o";
         pthread_t thread_id[4];
-        struct bpf_object *obj;
+        struct bpf_object *obj = NULL;
         int prog_fd;
         int err = 0, i;
         void *ret;
diff --git a/tools/testing/selftests/bpf/progs/test_sock_fields_kern.c b/tools/testing/selftests/bpf/progs/test_sock_fields_kern.c
index de1a43e8f610..37328f148538 100644
--- a/tools/testing/selftests/bpf/progs/test_sock_fields_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_sock_fields_kern.c
@@ -8,38 +8,51 @@
 #include "bpf_helpers.h"
 #include "bpf_endian.h"
 
-enum bpf_array_idx {
-        SRV_IDX,
-        CLI_IDX,
-        __NR_BPF_ARRAY_IDX,
+enum bpf_addr_array_idx {
+        ADDR_SRV_IDX,
+        ADDR_CLI_IDX,
+        __NR_BPF_ADDR_ARRAY_IDX,
+};
+
+enum bpf_result_array_idx {
+        EGRESS_SRV_IDX,
+        EGRESS_CLI_IDX,
+        INGRESS_LISTEN_IDX,
+        __NR_BPF_RESULT_ARRAY_IDX,
+};
+
+enum bpf_linum_array_idx {
+        EGRESS_LINUM_IDX,
+        INGRESS_LINUM_IDX,
+        __NR_BPF_LINUM_ARRAY_IDX,
 };
 
 struct bpf_map_def SEC("maps") addr_map = {
         .type = BPF_MAP_TYPE_ARRAY,
         .key_size = sizeof(__u32),
         .value_size = sizeof(struct sockaddr_in6),
-        .max_entries = __NR_BPF_ARRAY_IDX,
+        .max_entries = __NR_BPF_ADDR_ARRAY_IDX,
 };
 
 struct bpf_map_def SEC("maps") sock_result_map = {
         .type = BPF_MAP_TYPE_ARRAY,
         .key_size = sizeof(__u32),
         .value_size = sizeof(struct bpf_sock),
-        .max_entries = __NR_BPF_ARRAY_IDX,
+        .max_entries = __NR_BPF_RESULT_ARRAY_IDX,
 };
 
 struct bpf_map_def SEC("maps") tcp_sock_result_map = {
         .type = BPF_MAP_TYPE_ARRAY,
         .key_size = sizeof(__u32),
         .value_size = sizeof(struct bpf_tcp_sock),
-        .max_entries = __NR_BPF_ARRAY_IDX,
+        .max_entries = __NR_BPF_RESULT_ARRAY_IDX,
 };
 
 struct bpf_map_def SEC("maps") linum_map = {
         .type = BPF_MAP_TYPE_ARRAY,
         .key_size = sizeof(__u32),
         .value_size = sizeof(__u32),
-        .max_entries = 1,
+        .max_entries = __NR_BPF_LINUM_ARRAY_IDX,
 };
 
 static bool is_loopback6(__u32 *a6)
@@ -100,18 +113,20 @@ static void tpcpy(struct bpf_tcp_sock *dst,
 
 #define RETURN {                                                \
         linum = __LINE__;                                       \
-        bpf_map_update_elem(&linum_map, &idx0, &linum, 0);      \
+        bpf_map_update_elem(&linum_map, &linum_idx, &linum, 0); \
         return 1;                                               \
 }
 
 SEC("cgroup_skb/egress")
-int read_sock_fields(struct __sk_buff *skb)
+int egress_read_sock_fields(struct __sk_buff *skb)
 {
-        __u32 srv_idx = SRV_IDX, cli_idx = CLI_IDX, idx;
+        __u32 srv_idx = ADDR_SRV_IDX, cli_idx = ADDR_CLI_IDX, result_idx;
         struct sockaddr_in6 *srv_sa6, *cli_sa6;
         struct bpf_tcp_sock *tp, *tp_ret;
         struct bpf_sock *sk, *sk_ret;
-        __u32 linum, idx0 = 0;
+        __u32 linum, linum_idx;
+
+        linum_idx = EGRESS_LINUM_IDX;
 
         sk = skb->sk;
         if (!sk || sk->state == 10)
@@ -132,14 +147,55 @@ int read_sock_fields(struct __sk_buff *skb)
                 RETURN;
 
         if (sk->src_port == bpf_ntohs(srv_sa6->sin6_port))
-                idx = srv_idx;
+                result_idx = EGRESS_SRV_IDX;
         else if (sk->src_port == bpf_ntohs(cli_sa6->sin6_port))
-                idx = cli_idx;
+                result_idx = EGRESS_CLI_IDX;
         else
                 RETURN;
 
-        sk_ret = bpf_map_lookup_elem(&sock_result_map, &idx);
-        tp_ret = bpf_map_lookup_elem(&tcp_sock_result_map, &idx);
+        sk_ret = bpf_map_lookup_elem(&sock_result_map, &result_idx);
+        tp_ret = bpf_map_lookup_elem(&tcp_sock_result_map, &result_idx);
+        if (!sk_ret || !tp_ret)
+                RETURN;
+
+        skcpy(sk_ret, sk);
+        tpcpy(tp_ret, tp);
+
+        RETURN;
+}
+
+SEC("cgroup_skb/ingress")
+int ingress_read_sock_fields(struct __sk_buff *skb)
+{
+        __u32 srv_idx = ADDR_SRV_IDX, result_idx = INGRESS_LISTEN_IDX;
+        struct bpf_tcp_sock *tp, *tp_ret;
+        struct bpf_sock *sk, *sk_ret;
+        struct sockaddr_in6 *srv_sa6;
+        __u32 linum, linum_idx;
+
+        linum_idx = INGRESS_LINUM_IDX;
+
+        sk = skb->sk;
+        if (!sk || sk->family != AF_INET6 || !is_loopback6(sk->src_ip6))
+                RETURN;
+
+        srv_sa6 = bpf_map_lookup_elem(&addr_map, &srv_idx);
+        if (!srv_sa6 || sk->src_port != bpf_ntohs(srv_sa6->sin6_port))
+                RETURN;
+
+        if (sk->state != 10 && sk->state != 12)
+                RETURN;
+
+        sk = bpf_get_listener_sock(sk);
+        if (!sk)
+                RETURN;
+
+        tp = bpf_tcp_sock(sk);
+        if (!tp)
+                RETURN;
+
+        sk_ret = bpf_map_lookup_elem(&sock_result_map, &result_idx);
+        tp_ret = bpf_map_lookup_elem(&tcp_sock_result_map, &result_idx);
         if (!sk_ret || !tp_ret)
                 RETURN;
 
diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c
index 38797aa627a7..23e3b314ca60 100644
--- a/tools/testing/selftests/bpf/test_btf.c
+++ b/tools/testing/selftests/bpf/test_btf.c
@@ -5874,6 +5874,50 @@ const struct btf_dedup_test dedup_tests[] = {
                 .dont_resolve_fwds = false,
         },
 },
+{
+        .descr = "dedup: enum fwd resolution",
+        .input = {
+                .raw_types = {
+                        /* [1] fwd enum 'e1' before full enum */
+                        BTF_TYPE_ENC(NAME_NTH(1), BTF_INFO_ENC(BTF_KIND_ENUM, 0, 0), 4),
+                        /* [2] full enum 'e1' after fwd */
+                        BTF_TYPE_ENC(NAME_NTH(1), BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1), 4),
+                                BTF_ENUM_ENC(NAME_NTH(2), 123),
+                        /* [3] full enum 'e2' before fwd */
+                        BTF_TYPE_ENC(NAME_NTH(3), BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1), 4),
+                                BTF_ENUM_ENC(NAME_NTH(4), 456),
+                        /* [4] fwd enum 'e2' after full enum */
+                        BTF_TYPE_ENC(NAME_NTH(3), BTF_INFO_ENC(BTF_KIND_ENUM, 0, 0), 4),
+                        /* [5] incompatible fwd enum with different size */
+                        BTF_TYPE_ENC(NAME_NTH(1), BTF_INFO_ENC(BTF_KIND_ENUM, 0, 0), 1),
+                        /* [6] incompatible full enum with different value */
+                        BTF_TYPE_ENC(NAME_NTH(1), BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1), 4),
+                                BTF_ENUM_ENC(NAME_NTH(2), 321),
+                        BTF_END_RAW,
+                },
+                BTF_STR_SEC("\0e1\0e1_val\0e2\0e2_val"),
+        },
+        .expect = {
+                .raw_types = {
+                        /* [1] full enum 'e1' */
+                        BTF_TYPE_ENC(NAME_NTH(1), BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1), 4),
+                                BTF_ENUM_ENC(NAME_NTH(2), 123),
+                        /* [2] full enum 'e2' */
+                        BTF_TYPE_ENC(NAME_NTH(3), BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1), 4),
+                                BTF_ENUM_ENC(NAME_NTH(4), 456),
+                        /* [3] incompatible fwd enum with different size */
+                        BTF_TYPE_ENC(NAME_NTH(1), BTF_INFO_ENC(BTF_KIND_ENUM, 0, 0), 1),
+                        /* [4] incompatible full enum with different value */
+                        BTF_TYPE_ENC(NAME_NTH(1), BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1), 4),
+                                BTF_ENUM_ENC(NAME_NTH(2), 321),
+                        BTF_END_RAW,
+                },
+                BTF_STR_SEC("\0e1\0e1_val\0e2\0e2_val"),
+        },
+        .opts = {
+                .dont_resolve_fwds = false,
+        },
+},
 
 };
 
diff --git a/tools/testing/selftests/bpf/test_sock_fields.c b/tools/testing/selftests/bpf/test_sock_fields.c
index bc8943938bf5..dcae7f664dce 100644
--- a/tools/testing/selftests/bpf/test_sock_fields.c
+++ b/tools/testing/selftests/bpf/test_sock_fields.c
@@ -16,10 +16,23 @@
 #include "cgroup_helpers.h"
 #include "bpf_rlimit.h"
 
-enum bpf_array_idx {
-        SRV_IDX,
-        CLI_IDX,
-        __NR_BPF_ARRAY_IDX,
+enum bpf_addr_array_idx {
+        ADDR_SRV_IDX,
+        ADDR_CLI_IDX,
+        __NR_BPF_ADDR_ARRAY_IDX,
+};
+
+enum bpf_result_array_idx {
+        EGRESS_SRV_IDX,
+        EGRESS_CLI_IDX,
+        INGRESS_LISTEN_IDX,
+        __NR_BPF_RESULT_ARRAY_IDX,
+};
+
+enum bpf_linum_array_idx {
+        EGRESS_LINUM_IDX,
+        INGRESS_LINUM_IDX,
+        __NR_BPF_LINUM_ARRAY_IDX,
 };
 
 #define CHECK(condition, tag, format...) ({                             \
@@ -41,8 +54,16 @@ static int linum_map_fd;
 static int addr_map_fd;
 static int tp_map_fd;
 static int sk_map_fd;
-static __u32 srv_idx = SRV_IDX;
-static __u32 cli_idx = CLI_IDX;
+
+static __u32 addr_srv_idx = ADDR_SRV_IDX;
+static __u32 addr_cli_idx = ADDR_CLI_IDX;
+
+static __u32 egress_srv_idx = EGRESS_SRV_IDX;
+static __u32 egress_cli_idx = EGRESS_CLI_IDX;
+static __u32 ingress_listen_idx = INGRESS_LISTEN_IDX;
+
+static __u32 egress_linum_idx = EGRESS_LINUM_IDX;
+static __u32 ingress_linum_idx = INGRESS_LINUM_IDX;
 
 static void init_loopback6(struct sockaddr_in6 *sa6)
 {
@@ -93,29 +114,46 @@ static void print_tp(const struct bpf_tcp_sock *tp)
 
 static void check_result(void)
 {
-        struct bpf_tcp_sock srv_tp, cli_tp;
-        struct bpf_sock srv_sk, cli_sk;
-        __u32 linum, idx0 = 0;
+        struct bpf_tcp_sock srv_tp, cli_tp, listen_tp;
+        struct bpf_sock srv_sk, cli_sk, listen_sk;
+        __u32 ingress_linum, egress_linum;
         int err;
 
-        err = bpf_map_lookup_elem(linum_map_fd, &idx0, &linum);
+        err = bpf_map_lookup_elem(linum_map_fd, &egress_linum_idx,
+                                  &egress_linum);
         CHECK(err == -1, "bpf_map_lookup_elem(linum_map_fd)",
               "err:%d errno:%d", err, errno);
 
-        err = bpf_map_lookup_elem(sk_map_fd, &srv_idx, &srv_sk);
-        CHECK(err == -1, "bpf_map_lookup_elem(sk_map_fd, &srv_idx)",
+        err = bpf_map_lookup_elem(linum_map_fd, &ingress_linum_idx,
+                                  &ingress_linum);
+        CHECK(err == -1, "bpf_map_lookup_elem(linum_map_fd)",
+              "err:%d errno:%d", err, errno);
+
+        err = bpf_map_lookup_elem(sk_map_fd, &egress_srv_idx, &srv_sk);
+        CHECK(err == -1, "bpf_map_lookup_elem(sk_map_fd, &egress_srv_idx)",
+              "err:%d errno:%d", err, errno);
+        err = bpf_map_lookup_elem(tp_map_fd, &egress_srv_idx, &srv_tp);
+        CHECK(err == -1, "bpf_map_lookup_elem(tp_map_fd, &egress_srv_idx)",
+              "err:%d errno:%d", err, errno);
+
+        err = bpf_map_lookup_elem(sk_map_fd, &egress_cli_idx, &cli_sk);
+        CHECK(err == -1, "bpf_map_lookup_elem(sk_map_fd, &egress_cli_idx)",
               "err:%d errno:%d", err, errno);
-        err = bpf_map_lookup_elem(tp_map_fd, &srv_idx, &srv_tp);
-        CHECK(err == -1, "bpf_map_lookup_elem(tp_map_fd, &srv_idx)",
+        err = bpf_map_lookup_elem(tp_map_fd, &egress_cli_idx, &cli_tp);
+        CHECK(err == -1, "bpf_map_lookup_elem(tp_map_fd, &egress_cli_idx)",
               "err:%d errno:%d", err, errno);
 
-        err = bpf_map_lookup_elem(sk_map_fd, &cli_idx, &cli_sk);
-        CHECK(err == -1, "bpf_map_lookup_elem(sk_map_fd, &cli_idx)",
+        err = bpf_map_lookup_elem(sk_map_fd, &ingress_listen_idx, &listen_sk);
+        CHECK(err == -1, "bpf_map_lookup_elem(sk_map_fd, &ingress_listen_idx)",
               "err:%d errno:%d", err, errno);
-        err = bpf_map_lookup_elem(tp_map_fd, &cli_idx, &cli_tp);
-        CHECK(err == -1, "bpf_map_lookup_elem(tp_map_fd, &cli_idx)",
+        err = bpf_map_lookup_elem(tp_map_fd, &ingress_listen_idx, &listen_tp);
+        CHECK(err == -1, "bpf_map_lookup_elem(tp_map_fd, &ingress_listen_idx)",
               "err:%d errno:%d", err, errno);
 
+        printf("listen_sk: ");
+        print_sk(&listen_sk);
+        printf("\n");
+
         printf("srv_sk: ");
         print_sk(&srv_sk);
         printf("\n");
@@ -124,6 +162,10 @@ static void check_result(void)
         print_sk(&cli_sk);
         printf("\n");
 
+        printf("listen_tp: ");
+        print_tp(&listen_tp);
+        printf("\n");
+
         printf("srv_tp: ");
         print_tp(&srv_tp);
         printf("\n");
@@ -132,6 +174,19 @@ static void check_result(void)
         print_tp(&cli_tp);
         printf("\n");
 
+        CHECK(listen_sk.state != 10 ||
+              listen_sk.family != AF_INET6 ||
+              listen_sk.protocol != IPPROTO_TCP ||
+              memcmp(listen_sk.src_ip6, &in6addr_loopback,
+                     sizeof(listen_sk.src_ip6)) ||
+              listen_sk.dst_ip6[0] || listen_sk.dst_ip6[1] ||
+              listen_sk.dst_ip6[2] || listen_sk.dst_ip6[3] ||
+              listen_sk.src_port != ntohs(srv_sa6.sin6_port) ||
+              listen_sk.dst_port,
+              "Unexpected listen_sk",
+              "Check listen_sk output. ingress_linum:%u",
+              ingress_linum);
+
         CHECK(srv_sk.state == 10 ||
               !srv_sk.state ||
               srv_sk.family != AF_INET6 ||
@@ -142,7 +197,8 @@ static void check_result(void)
                      sizeof(srv_sk.dst_ip6)) ||
               srv_sk.src_port != ntohs(srv_sa6.sin6_port) ||
               srv_sk.dst_port != cli_sa6.sin6_port,
-              "Unexpected srv_sk", "Check srv_sk output. linum:%u", linum);
+              "Unexpected srv_sk", "Check srv_sk output. egress_linum:%u",
+              egress_linum);
 
         CHECK(cli_sk.state == 10 ||
               !cli_sk.state ||
@@ -154,21 +210,31 @@ static void check_result(void)
                      sizeof(cli_sk.dst_ip6)) ||
               cli_sk.src_port != ntohs(cli_sa6.sin6_port) ||
               cli_sk.dst_port != srv_sa6.sin6_port,
-              "Unexpected cli_sk", "Check cli_sk output. linum:%u", linum);
+              "Unexpected cli_sk", "Check cli_sk output. egress_linum:%u",
+              egress_linum);
+
+        CHECK(listen_tp.data_segs_out ||
+              listen_tp.data_segs_in ||
+              listen_tp.total_retrans ||
+              listen_tp.bytes_acked,
+              "Unexpected listen_tp", "Check listen_tp output. ingress_linum:%u",
+              ingress_linum);
 
         CHECK(srv_tp.data_segs_out != 1 ||
               srv_tp.data_segs_in ||
               srv_tp.snd_cwnd != 10 ||
               srv_tp.total_retrans ||
               srv_tp.bytes_acked != DATA_LEN,
-              "Unexpected srv_tp", "Check srv_tp output. linum:%u", linum);
+              "Unexpected srv_tp", "Check srv_tp output. egress_linum:%u",
+              egress_linum);
 
         CHECK(cli_tp.data_segs_out ||
               cli_tp.data_segs_in != 1 ||
               cli_tp.snd_cwnd != 10 ||
               cli_tp.total_retrans ||
               cli_tp.bytes_received != DATA_LEN,
-              "Unexpected cli_tp", "Check cli_tp output. linum:%u", linum);
+              "Unexpected cli_tp", "Check cli_tp output. egress_linum:%u",
+              egress_linum);
 }
 
 static void test(void)
@@ -211,10 +277,10 @@ static void test(void)
               err, errno);
 
         /* Update addr_map with srv_sa6 and cli_sa6 */
-        err = bpf_map_update_elem(addr_map_fd, &srv_idx, &srv_sa6, 0);
+        err = bpf_map_update_elem(addr_map_fd, &addr_srv_idx, &srv_sa6, 0);
         CHECK(err, "map_update", "err:%d errno:%d", err, errno);
 
-        err = bpf_map_update_elem(addr_map_fd, &cli_idx, &cli_sa6, 0);
+        err = bpf_map_update_elem(addr_map_fd, &addr_cli_idx, &cli_sa6, 0);
         CHECK(err, "map_update", "err:%d errno:%d", err, errno);
 
         /* Connect from cli_sa6 to srv_sa6 */
@@ -273,9 +339,9 @@ int main(int argc, char **argv)
         struct bpf_prog_load_attr attr = {
                 .file = "test_sock_fields_kern.o",
                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-                .expected_attach_type = BPF_CGROUP_INET_EGRESS,
         };
-        int cgroup_fd, prog_fd, err;
+        int cgroup_fd, egress_fd, ingress_fd, err;
+        struct bpf_program *ingress_prog;
         struct bpf_object *obj;
         struct bpf_map *map;
 
@@ -293,12 +359,24 @@ int main(int argc, char **argv)
         err = join_cgroup(TEST_CGROUP);
         CHECK(err, "join_cgroup", "err:%d errno:%d", err, errno);
 
-        err = bpf_prog_load_xattr(&attr, &obj, &prog_fd);
+        err = bpf_prog_load_xattr(&attr, &obj, &egress_fd);
         CHECK(err, "bpf_prog_load_xattr()", "err:%d", err);
 
-        err = bpf_prog_attach(prog_fd, cgroup_fd, BPF_CGROUP_INET_EGRESS, 0);
+        ingress_prog = bpf_object__find_program_by_title(obj,
+                                                         "cgroup_skb/ingress");
+        CHECK(!ingress_prog,
+              "bpf_object__find_program_by_title(cgroup_skb/ingress)",
+              "not found");
+        ingress_fd = bpf_program__fd(ingress_prog);
+
+        err = bpf_prog_attach(egress_fd, cgroup_fd, BPF_CGROUP_INET_EGRESS, 0);
         CHECK(err == -1, "bpf_prog_attach(CPF_CGROUP_INET_EGRESS)",
               "err:%d errno%d", err, errno);
+
+        err = bpf_prog_attach(ingress_fd, cgroup_fd,
+                              BPF_CGROUP_INET_INGRESS, 0);
+        CHECK(err == -1, "bpf_prog_attach(CPF_CGROUP_INET_INGRESS)",
+              "err:%d errno%d", err, errno);
         close(cgroup_fd);
 
         map = bpf_object__find_map_by_name(obj, "addr_map");
diff --git a/tools/testing/selftests/bpf/verifier/ref_tracking.c b/tools/testing/selftests/bpf/verifier/ref_tracking.c
index 3ed3593bd8b6..923f2110072d 100644
--- a/tools/testing/selftests/bpf/verifier/ref_tracking.c
+++ b/tools/testing/selftests/bpf/verifier/ref_tracking.c
@@ -605,3 +605,171 @@
         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
         .result = ACCEPT,
 },
+{
+        "reference tracking: use ptr from bpf_tcp_sock() after release",
+        .insns = {
+        BPF_SK_LOOKUP,
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+        BPF_EMIT_CALL(BPF_FUNC_tcp_sock),
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_7, offsetof(struct bpf_tcp_sock, snd_cwnd)),
+        BPF_EXIT_INSN(),
+        },
+        .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        .result = REJECT,
+        .errstr = "invalid mem access",
+},
+{
+        "reference tracking: use ptr from bpf_sk_fullsock() after release",
+        .insns = {
+        BPF_SK_LOOKUP,
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+        BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_7, offsetof(struct bpf_sock, type)),
+        BPF_EXIT_INSN(),
+        },
+        .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        .result = REJECT,
+        .errstr = "invalid mem access",
+},
+{
+        "reference tracking: use ptr from bpf_sk_fullsock(tp) after release",
+        .insns = {
+        BPF_SK_LOOKUP,
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+        BPF_EMIT_CALL(BPF_FUNC_tcp_sock),
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+        BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 1),
+        BPF_EXIT_INSN(),
+        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6, offsetof(struct bpf_sock, type)),
+        BPF_EXIT_INSN(),
+        },
+        .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        .result = REJECT,
+        .errstr = "invalid mem access",
+},
+{
+        "reference tracking: use sk after bpf_sk_release(tp)",
+        .insns = {
+        BPF_SK_LOOKUP,
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+        BPF_EMIT_CALL(BPF_FUNC_tcp_sock),
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6, offsetof(struct bpf_sock, type)),
+        BPF_EXIT_INSN(),
+        },
+        .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        .result = REJECT,
+        .errstr = "invalid mem access",
+},
+{
+        "reference tracking: use ptr from bpf_get_listener_sock() after bpf_sk_release(sk)",
+        .insns = {
+        BPF_SK_LOOKUP,
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+        BPF_EMIT_CALL(BPF_FUNC_get_listener_sock),
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6, offsetof(struct bpf_sock, src_port)),
+        BPF_EXIT_INSN(),
+        },
+        .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        .result = ACCEPT,
+},
+{
+        "reference tracking: bpf_sk_release(listen_sk)",
+        .insns = {
+        BPF_SK_LOOKUP,
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+        BPF_EMIT_CALL(BPF_FUNC_get_listener_sock),
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 3),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6, offsetof(struct bpf_sock, type)),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_EXIT_INSN(),
+        },
+        .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        .result = REJECT,
+        .errstr = "reference has not been acquired before",
+},
+{
+        /* !bpf_sk_fullsock(sk) is checked but !bpf_tcp_sock(sk) is not checked */
+        "reference tracking: tp->snd_cwnd after bpf_sk_fullsock(sk) and bpf_tcp_sock(sk)",
+        .insns = {
+        BPF_SK_LOOKUP,
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+        BPF_EXIT_INSN(),
+        BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+        BPF_EMIT_CALL(BPF_FUNC_sk_fullsock),
+        BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_EMIT_CALL(BPF_FUNC_tcp_sock),
+        BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
+        BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0, 3),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_EXIT_INSN(),
+        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_8, offsetof(struct bpf_tcp_sock, snd_cwnd)),
+        BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+        BPF_EMIT_CALL(BPF_FUNC_sk_release),
+        BPF_EXIT_INSN(),
+        },
+        .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        .result = REJECT,
+        .errstr = "invalid mem access",
+},
diff --git a/tools/testing/selftests/bpf/verifier/sock.c b/tools/testing/selftests/bpf/verifier/sock.c
index 0ddfdf76aba5..416436231fab 100644
--- a/tools/testing/selftests/bpf/verifier/sock.c
+++ b/tools/testing/selftests/bpf/verifier/sock.c
@@ -342,7 +342,7 @@
         },
         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
         .result = REJECT,
-        .errstr = "type=sock_common expected=sock",
+        .errstr = "reference has not been acquired before",
 },
 {
         "bpf_sk_release(bpf_sk_fullsock(skb->sk))",
@@ -380,5 +380,5 @@
         },
         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
         .result = REJECT,
-        .errstr = "type=tcp_sock expected=sock",
+        .errstr = "reference has not been acquired before",
 },