Cover what the verifier has to get right for the msk returned by
bpf_skc_to_mptcp_sock(): it must not be accepted by bpf_sk_release(), it
must go away with the subflow it was derived from, and the subflow
reference still has to be released.

  # ./test_progs -t verifier_mptcp
  #658/1   verifier_mptcp/bpf_skc_to_mptcp_sock: release the acquired subflow:OK
  #658/2   verifier_mptcp/bpf_skc_to_mptcp_sock: msk is not the acquired subflow:OK
  #658/3   verifier_mptcp/bpf_skc_to_mptcp_sock: msk dies with the subflow it came from:OK
  #658/4   verifier_mptcp/bpf_skc_to_mptcp_sock: subflow is still owned after the cast:OK
  #658     verifier_mptcp:OK
  Summary: 1/4 PASSED, 0 SKIPPED, 0/0 FAILED

Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 .../selftests/bpf/prog_tests/verifier.c       |   2 +
 .../selftests/bpf/progs/verifier_mptcp.c      | 101 ++++++++++++++++++
 2 files changed, 103 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/progs/verifier_mptcp.c

diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
index f7f94ccebce2..63316e4be6bb 100644
--- a/tools/testing/selftests/bpf/prog_tests/verifier.c
+++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
@@ -74,6 +74,7 @@
 #include "verifier_mem_size_reg.skel.h"
 #include "verifier_meta_access.skel.h"
 #include "verifier_movsx.skel.h"
+#include "verifier_mptcp.skel.h"
 #include "verifier_mtu.skel.h"
 #include "verifier_mul.skel.h"
 #include "verifier_netfilter_ctx.skel.h"
@@ -238,6 +239,7 @@ void test_verifier_may_goto_2(void)           { RUN(verifier_may_goto_2); }
 void test_verifier_mem_size_reg(void)         { RUN(verifier_mem_size_reg); }
 void test_verifier_meta_access(void)          { RUN(verifier_meta_access); }
 void test_verifier_movsx(void)                 { RUN(verifier_movsx); }
+void test_verifier_mptcp(void)                { RUN(verifier_mptcp); }
 void test_verifier_mul(void)                  { RUN(verifier_mul); }
 void test_verifier_netfilter_ctx(void)        { RUN(verifier_netfilter_ctx); }
 void test_verifier_netfilter_retcode(void)    { RUN(verifier_netfilter_retcode); }
diff --git a/tools/testing/selftests/bpf/progs/verifier_mptcp.c b/tools/testing/selftests/bpf/progs/verifier_mptcp.c
new file mode 100644
index 000000000000..1f679265e043
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/verifier_mptcp.c
@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include "bpf_tracing_net.h"
+#include <bpf/bpf_helpers.h>
+#include "bpf_misc.h"
+
+char _license[] SEC("license") = "GPL";
+
+__u32 token;
+
+static __always_inline struct bpf_sock *lookup_subflow(struct __sk_buff *skb)
+{
+	struct bpf_sock_tuple tuple = {};
+
+	return bpf_skc_lookup_tcp(skb, &tuple, sizeof(tuple.ipv4),
+				  BPF_F_CURRENT_NETNS, 0);
+}
+
+SEC("tc")
+__description("bpf_skc_to_mptcp_sock: release the acquired subflow")
+__success
+int mptcp_cast_release_subflow(struct __sk_buff *skb)
+{
+	struct mptcp_sock *msk;
+	struct bpf_sock *sk;
+
+	sk = lookup_subflow(skb);
+	if (!sk)
+		return 0;
+
+	msk = bpf_skc_to_mptcp_sock(sk);
+	if (msk)
+		token = msk->token;
+
+	bpf_sk_release(sk);
+	return 0;
+}
+
+SEC("tc")
+__description("bpf_skc_to_mptcp_sock: msk is not the acquired subflow")
+__failure __msg("release helper bpf_sk_release expects referenced PTR_TO_BTF_ID")
+int mptcp_cast_release_msk(struct __sk_buff *skb)
+{
+	struct mptcp_sock *msk;
+	struct bpf_sock *sk;
+
+	sk = lookup_subflow(skb);
+	if (!sk)
+		return 0;
+
+	msk = bpf_skc_to_mptcp_sock(sk);
+	if (!msk) {
+		bpf_sk_release(sk);
+		return 0;
+	}
+
+	bpf_sk_release((struct bpf_sock *)msk);
+	return 0;
+}
+
+SEC("tc")
+__description("bpf_skc_to_mptcp_sock: msk dies with the subflow it came from")
+__failure __msg("invalid mem access 'scalar'")
+int mptcp_cast_use_after_release(struct __sk_buff *skb)
+{
+	struct mptcp_sock *msk;
+	struct bpf_sock *sk;
+
+	sk = lookup_subflow(skb);
+	if (!sk)
+		return 0;
+
+	msk = bpf_skc_to_mptcp_sock(sk);
+	if (!msk) {
+		bpf_sk_release(sk);
+		return 0;
+	}
+
+	bpf_sk_release(sk);
+	token = msk->token;
+	return 0;
+}
+
+SEC("tc")
+__description("bpf_skc_to_mptcp_sock: subflow is still owned after the cast")
+__failure __msg("Unreleased reference")
+int mptcp_cast_leak_subflow(struct __sk_buff *skb)
+{
+	struct mptcp_sock *msk;
+	struct bpf_sock *sk;
+
+	sk = lookup_subflow(skb);
+	if (!sk)
+		return 0;
+
+	msk = bpf_skc_to_mptcp_sock(sk);
+	if (msk)
+		token = msk->token;
+
+	return 0;
+}
-- 
2.43.0