diff mbox series

[bpf] selftests/bpf: fix memory leak of lsm_cgroup

Message ID 1668401942-6309-1-git-send-email-wangyufen@huawei.com (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series [bpf] selftests/bpf: fix memory leak of lsm_cgroup | expand

Checks

Context Check Description
netdev/tree_selection success Clearly marked for bpf
netdev/fixes_present success Fixes tag present in non-next series
netdev/subject_prefix success Link
netdev/cover_letter success Single patches do not need cover letters
netdev/patch_count success Link
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/cc_maintainers warning 9 maintainers not CCed: kpsingh@kernel.org mykolal@fb.com haoluo@google.com linux-kselftest@vger.kernel.org yhs@fb.com shuah@kernel.org jolsa@kernel.org song@kernel.org john.fastabend@gmail.com
netdev/build_clang success Errors and warnings before: 0 this patch: 0
netdev/module_param success Was 0 now: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success Fixes tag looks correct
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/checkpatch warning CHECK: Logical continuations should be on the previous line WARNING: externs should be avoided in .c files WARNING: line length of 86 exceeds 80 columns WARNING: line length of 89 exceeds 80 columns WARNING: line length of 98 exceeds 80 columns
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-PR success PR summary
bpf/vmtest-bpf-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-VM_Test-2 success Logs for build for aarch64 with gcc
bpf/vmtest-bpf-VM_Test-3 success Logs for build for aarch64 with llvm-16
bpf/vmtest-bpf-VM_Test-5 success Logs for build for x86_64 with gcc
bpf/vmtest-bpf-VM_Test-6 success Logs for build for x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-7 success Logs for llvm-toolchain
bpf/vmtest-bpf-VM_Test-8 success Logs for set-matrix
bpf/vmtest-bpf-VM_Test-4 success Logs for build for s390x with gcc
bpf/vmtest-bpf-VM_Test-9 success Logs for test_maps on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-10 success Logs for test_maps on aarch64 with llvm-16
bpf/vmtest-bpf-VM_Test-12 success Logs for test_maps on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-13 success Logs for test_maps on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-19 success Logs for test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-20 success Logs for test_progs_no_alu32 on aarch64 with llvm-16
bpf/vmtest-bpf-VM_Test-22 fail Logs for test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-23 success Logs for test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-24 success Logs for test_progs_no_alu32_parallel on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-25 success Logs for test_progs_no_alu32_parallel on aarch64 with llvm-16
bpf/vmtest-bpf-VM_Test-27 success Logs for test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-28 success Logs for test_progs_no_alu32_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-29 success Logs for test_progs_parallel on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-30 success Logs for test_progs_parallel on aarch64 with llvm-16
bpf/vmtest-bpf-VM_Test-32 success Logs for test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-33 success Logs for test_progs_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-34 success Logs for test_verifier on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-35 success Logs for test_verifier on aarch64 with llvm-16
bpf/vmtest-bpf-VM_Test-36 success Logs for test_verifier on s390x with gcc
bpf/vmtest-bpf-VM_Test-37 success Logs for test_verifier on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-38 success Logs for test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-14 fail Logs for test_progs on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-15 success Logs for test_progs on aarch64 with llvm-16
bpf/vmtest-bpf-VM_Test-17 success Logs for test_progs on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-18 fail Logs for test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-26 success Logs for test_progs_no_alu32_parallel on s390x with gcc
bpf/vmtest-bpf-VM_Test-31 success Logs for test_progs_parallel on s390x with gcc
bpf/vmtest-bpf-VM_Test-16 success Logs for test_progs on s390x with gcc
bpf/vmtest-bpf-VM_Test-21 success Logs for test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-VM_Test-11 success Logs for test_maps on s390x with gcc

Commit Message

wangyufen Nov. 14, 2022, 4:59 a.m. UTC 
kmemleak reports this issue:

unreferenced object 0xffff88810b7835c0 (size 32):
  comm "test_progs", pid 270, jiffies 4294969007 (age 1621.315s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    03 00 00 00 03 00 00 00 0f 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000376cdeab>] kmalloc_trace+0x27/0x110
    [<000000003bcdb3b6>] selinux_sk_alloc_security+0x66/0x110
    [<000000003959008f>] security_sk_alloc+0x47/0x80
    [<00000000e7bc6668>] sk_prot_alloc+0xbd/0x1a0
    [<0000000002d6343a>] sk_alloc+0x3b/0x940
    [<000000009812a46d>] unix_create1+0x8f/0x3d0
    [<000000005ed0976b>] unix_create+0xa1/0x150
    [<0000000086a1d27f>] __sock_create+0x233/0x4a0
    [<00000000cffe3a73>] __sys_socket_create.part.0+0xaa/0x110
    [<0000000007c63f20>] __sys_socket+0x49/0xf0
    [<00000000b08753c8>] __x64_sys_socket+0x42/0x50
    [<00000000b56e26b3>] do_syscall_64+0x3b/0x90
    [<000000009b4871b8>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

The issue occurs in the following scenarios:

unix_create1()
  sk_alloc()
    sk_prot_alloc()
      security_sk_alloc()
        call_int_hook()
          hlist_for_each_entry()
            entry1->hook.sk_alloc_security
            <-- selinux_sk_alloc_security() succeeded,
            <-- sk->security alloced here.
            entry2->hook.sk_alloc_security
            <-- bpf_lsm_sk_alloc_security() failed
      goto out_free;
        ...    <-- the sk->security not freed, memleak

The core problem is that the LSM is not yet fully stacked (work is
actively going on in this space) which means that some LSM hooks do
not support multiple LSMs at the same time. To fix, skip the
"EPERM" test when it runs in the environments that already have
non-bpf lsms installed

Fixes: dca85aac8895 ("selftests/bpf: lsm_cgroup functional test")
Signed-off-by: Wang Yufen <wangyufen@huawei.com>
Cc: Stanislav Fomichev <sdf@google.com>
---
 tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c | 19 +++++++++++++++----
 tools/testing/selftests/bpf/progs/lsm_cgroup.c      |  8 ++++++++
 2 files changed, 23 insertions(+), 4 deletions(-)

Comments

Stanislav Fomichev Nov. 14, 2022, 5:34 p.m. UTC | #1 
On 11/14, Wang Yufen wrote:
> kmemleak reports this issue:

> unreferenced object 0xffff88810b7835c0 (size 32):
>    comm "test_progs", pid 270, jiffies 4294969007 (age 1621.315s)
>    hex dump (first 32 bytes):
>      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>      03 00 00 00 03 00 00 00 0f 00 00 00 00 00 00 00  ................
>    backtrace:
>      [<00000000376cdeab>] kmalloc_trace+0x27/0x110
>      [<000000003bcdb3b6>] selinux_sk_alloc_security+0x66/0x110
>      [<000000003959008f>] security_sk_alloc+0x47/0x80
>      [<00000000e7bc6668>] sk_prot_alloc+0xbd/0x1a0
>      [<0000000002d6343a>] sk_alloc+0x3b/0x940
>      [<000000009812a46d>] unix_create1+0x8f/0x3d0
>      [<000000005ed0976b>] unix_create+0xa1/0x150
>      [<0000000086a1d27f>] __sock_create+0x233/0x4a0
>      [<00000000cffe3a73>] __sys_socket_create.part.0+0xaa/0x110
>      [<0000000007c63f20>] __sys_socket+0x49/0xf0
>      [<00000000b08753c8>] __x64_sys_socket+0x42/0x50
>      [<00000000b56e26b3>] do_syscall_64+0x3b/0x90
>      [<000000009b4871b8>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

> The issue occurs in the following scenarios:

> unix_create1()
>    sk_alloc()
>      sk_prot_alloc()
>        security_sk_alloc()
>          call_int_hook()
>            hlist_for_each_entry()
>              entry1->hook.sk_alloc_security
>              <-- selinux_sk_alloc_security() succeeded,
>              <-- sk->security alloced here.
>              entry2->hook.sk_alloc_security
>              <-- bpf_lsm_sk_alloc_security() failed
>        goto out_free;
>          ...    <-- the sk->security not freed, memleak

> The core problem is that the LSM is not yet fully stacked (work is
> actively going on in this space) which means that some LSM hooks do
> not support multiple LSMs at the same time. To fix, skip the
> "EPERM" test when it runs in the environments that already have
> non-bpf lsms installed

> Fixes: dca85aac8895 ("selftests/bpf: lsm_cgroup functional test")
> Signed-off-by: Wang Yufen <wangyufen@huawei.com>
> Cc: Stanislav Fomichev <sdf@google.com>
> ---
>   tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c | 19  
> +++++++++++++++----
>   tools/testing/selftests/bpf/progs/lsm_cgroup.c      |  8 ++++++++
>   2 files changed, 23 insertions(+), 4 deletions(-)

> diff --git a/tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c  
> b/tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c
> index 1102e4f..a927ade 100644
> --- a/tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c
> +++ b/tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c
> @@ -173,10 +173,14 @@ static void test_lsm_cgroup_functional(void)
>   	ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
>   	ASSERT_EQ(query_prog_cnt(cgroup_fd2, NULL), 1, "total prog count");

> -	/* AF_UNIX is prohibited. */
> -
>   	fd = socket(AF_UNIX, SOCK_STREAM, 0);
> -	ASSERT_LT(fd, 0, "socket(AF_UNIX)");
> +	if (skel->kconfig->CONFIG_SECURITY_APPARMOR
> +	    || skel->kconfig->CONFIG_SECURITY_SELINUX
> +	    || skel->kconfig->CONFIG_SECURITY_SMACK)

[..]

> +		ASSERT_GE(fd, 0, "socket(AF_UNIX)");

nit: maybe skip this completely instead of having ASSERT_GE+close?

	if (!(skel->kconfig->CONFIG_SECURITY_APPARMOR || _SELINUX || _SMACK)
		/* AF_UNIX is prohibited. */
		ASSERT_LT(fd, 0, "socket(AF_UNIX)");


> +	else
> +		/* AF_UNIX is prohibited. */
> +		ASSERT_LT(fd, 0, "socket(AF_UNIX)");
>   	close(fd);

>   	/* AF_INET6 gets default policy (sk_priority). */
> @@ -233,11 +237,18 @@ static void test_lsm_cgroup_functional(void)

>   	/* AF_INET6+SOCK_STREAM
>   	 * AF_PACKET+SOCK_RAW
> +	 * AF_UNIX+SOCK_RAW if already have non-bpf lsms installed
>   	 * listen_fd
>   	 * client_fd
>   	 * accepted_fd
>   	 */
> -	ASSERT_EQ(skel->bss->called_socket_post_create2, 5, "called_create2");
> +	if (skel->kconfig->CONFIG_SECURITY_APPARMOR
> +	    || skel->kconfig->CONFIG_SECURITY_SELINUX
> +	    || skel->kconfig->CONFIG_SECURITY_SMACK)
> +		/* AF_UNIX+SOCK_RAW if already have non-bpf lsms installed */
> +		ASSERT_EQ(skel->bss->called_socket_post_create2, 6, "called_create2");
> +	else
> +		ASSERT_EQ(skel->bss->called_socket_post_create2, 5, "called_create2");

>   	/* start_server
>   	 * bind(ETH_P_ALL)
> diff --git a/tools/testing/selftests/bpf/progs/lsm_cgroup.c  
> b/tools/testing/selftests/bpf/progs/lsm_cgroup.c
> index 4f2d60b..02c11d1 100644
> --- a/tools/testing/selftests/bpf/progs/lsm_cgroup.c
> +++ b/tools/testing/selftests/bpf/progs/lsm_cgroup.c
> @@ -7,6 +7,10 @@

>   char _license[] SEC("license") = "GPL";

> +extern bool CONFIG_SECURITY_SELINUX __kconfig __weak;
> +extern bool CONFIG_SECURITY_SMACK __kconfig __weak;
> +extern bool CONFIG_SECURITY_APPARMOR __kconfig __weak;
> +
>   #ifndef AF_PACKET
>   #define AF_PACKET 17
>   #endif
> @@ -140,6 +144,10 @@ int BPF_PROG(socket_bind2, struct socket *sock,  
> struct sockaddr *address,
>   int BPF_PROG(socket_alloc, struct sock *sk, int family, gfp_t priority)
>   {
>   	called_socket_alloc++;
> +	/* if already have non-bpf lsms installed, EPERM will cause memory leak  
> of non-bpf lsms */
> +	if (CONFIG_SECURITY_SELINUX || CONFIG_SECURITY_SMACK ||  
> CONFIG_SECURITY_APPARMOR)
> +		return 1;
> +
>   	if (family == AF_UNIX)
>   		return 0; /* EPERM */

> --
> 1.8.3.1
wangyufen Nov. 15, 2022, 3:07 a.m. UTC | #2 
在 2022/11/15 1:34, sdf@google.com 写道:
> On 11/14, Wang Yufen wrote:
>> kmemleak reports this issue:
>
>> unreferenced object 0xffff88810b7835c0 (size 32):
>>    comm "test_progs", pid 270, jiffies 4294969007 (age 1621.315s)
>>    hex dump (first 32 bytes):
>>      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
>>      03 00 00 00 03 00 00 00 0f 00 00 00 00 00 00 00 ................
>>    backtrace:
>>      [<00000000376cdeab>] kmalloc_trace+0x27/0x110
>>      [<000000003bcdb3b6>] selinux_sk_alloc_security+0x66/0x110
>>      [<000000003959008f>] security_sk_alloc+0x47/0x80
>>      [<00000000e7bc6668>] sk_prot_alloc+0xbd/0x1a0
>>      [<0000000002d6343a>] sk_alloc+0x3b/0x940
>>      [<000000009812a46d>] unix_create1+0x8f/0x3d0
>>      [<000000005ed0976b>] unix_create+0xa1/0x150
>>      [<0000000086a1d27f>] __sock_create+0x233/0x4a0
>>      [<00000000cffe3a73>] __sys_socket_create.part.0+0xaa/0x110
>>      [<0000000007c63f20>] __sys_socket+0x49/0xf0
>>      [<00000000b08753c8>] __x64_sys_socket+0x42/0x50
>>      [<00000000b56e26b3>] do_syscall_64+0x3b/0x90
>>      [<000000009b4871b8>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
>> The issue occurs in the following scenarios:
>
>> unix_create1()
>>    sk_alloc()
>>      sk_prot_alloc()
>>        security_sk_alloc()
>>          call_int_hook()
>>            hlist_for_each_entry()
>>              entry1->hook.sk_alloc_security
>>              <-- selinux_sk_alloc_security() succeeded,
>>              <-- sk->security alloced here.
>>              entry2->hook.sk_alloc_security
>>              <-- bpf_lsm_sk_alloc_security() failed
>>        goto out_free;
>>          ...    <-- the sk->security not freed, memleak
>
>> The core problem is that the LSM is not yet fully stacked (work is
>> actively going on in this space) which means that some LSM hooks do
>> not support multiple LSMs at the same time. To fix, skip the
>> "EPERM" test when it runs in the environments that already have
>> non-bpf lsms installed
>
>> Fixes: dca85aac8895 ("selftests/bpf: lsm_cgroup functional test")
>> Signed-off-by: Wang Yufen <wangyufen@huawei.com>
>> Cc: Stanislav Fomichev <sdf@google.com>
>> ---
>>   tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c | 19 
>> +++++++++++++++----
>>   tools/testing/selftests/bpf/progs/lsm_cgroup.c      |  8 ++++++++
>>   2 files changed, 23 insertions(+), 4 deletions(-)
>
>> diff --git a/tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c 
>> b/tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c
>> index 1102e4f..a927ade 100644
>> --- a/tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c
>> +++ b/tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c
>> @@ -173,10 +173,14 @@ static void test_lsm_cgroup_functional(void)
>>       ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
>>       ASSERT_EQ(query_prog_cnt(cgroup_fd2, NULL), 1, "total prog 
>> count");
>
>> -    /* AF_UNIX is prohibited. */
>> -
>>       fd = socket(AF_UNIX, SOCK_STREAM, 0);
>> -    ASSERT_LT(fd, 0, "socket(AF_UNIX)");
>> +    if (skel->kconfig->CONFIG_SECURITY_APPARMOR
>> +        || skel->kconfig->CONFIG_SECURITY_SELINUX
>> +        || skel->kconfig->CONFIG_SECURITY_SMACK)
>
> [..]
>
>> +        ASSERT_GE(fd, 0, "socket(AF_UNIX)");
>
> nit: maybe skip this completely instead of having ASSERT_GE+close?
>
>     if (!(skel->kconfig->CONFIG_SECURITY_APPARMOR || _SELINUX || _SMACK)
>         /* AF_UNIX is prohibited. */
>         ASSERT_LT(fd, 0, "socket(AF_UNIX)");


OK, thanks! Will change in v2

>
>
>> +    else
>> +        /* AF_UNIX is prohibited. */
>> +        ASSERT_LT(fd, 0, "socket(AF_UNIX)");
>>       close(fd);
>
>>       /* AF_INET6 gets default policy (sk_priority). */
>> @@ -233,11 +237,18 @@ static void test_lsm_cgroup_functional(void)
>
>>       /* AF_INET6+SOCK_STREAM
>>        * AF_PACKET+SOCK_RAW
>> +     * AF_UNIX+SOCK_RAW if already have non-bpf lsms installed
>>        * listen_fd
>>        * client_fd
>>        * accepted_fd
>>        */
>> -    ASSERT_EQ(skel->bss->called_socket_post_create2, 5, 
>> "called_create2");
>> +    if (skel->kconfig->CONFIG_SECURITY_APPARMOR
>> +        || skel->kconfig->CONFIG_SECURITY_SELINUX
>> +        || skel->kconfig->CONFIG_SECURITY_SMACK)
>> +        /* AF_UNIX+SOCK_RAW if already have non-bpf lsms installed */
>> +        ASSERT_EQ(skel->bss->called_socket_post_create2, 6, 
>> "called_create2");
>> +    else
>> +        ASSERT_EQ(skel->bss->called_socket_post_create2, 5, 
>> "called_create2");
>
>>       /* start_server
>>        * bind(ETH_P_ALL)
>> diff --git a/tools/testing/selftests/bpf/progs/lsm_cgroup.c 
>> b/tools/testing/selftests/bpf/progs/lsm_cgroup.c
>> index 4f2d60b..02c11d1 100644
>> --- a/tools/testing/selftests/bpf/progs/lsm_cgroup.c
>> +++ b/tools/testing/selftests/bpf/progs/lsm_cgroup.c
>> @@ -7,6 +7,10 @@
>
>>   char _license[] SEC("license") = "GPL";
>
>> +extern bool CONFIG_SECURITY_SELINUX __kconfig __weak;
>> +extern bool CONFIG_SECURITY_SMACK __kconfig __weak;
>> +extern bool CONFIG_SECURITY_APPARMOR __kconfig __weak;
>> +
>>   #ifndef AF_PACKET
>>   #define AF_PACKET 17
>>   #endif
>> @@ -140,6 +144,10 @@ int BPF_PROG(socket_bind2, struct socket *sock, 
>> struct sockaddr *address,
>>   int BPF_PROG(socket_alloc, struct sock *sk, int family, gfp_t 
>> priority)
>>   {
>>       called_socket_alloc++;
>> +    /* if already have non-bpf lsms installed, EPERM will cause 
>> memory leak of non-bpf lsms */
>> +    if (CONFIG_SECURITY_SELINUX || CONFIG_SECURITY_SMACK || 
>> CONFIG_SECURITY_APPARMOR)
>> +        return 1;
>> +
>>       if (family == AF_UNIX)
>>           return 0; /* EPERM */
>
>> -- 
>> 1.8.3.1
>
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c b/tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c
index 1102e4f..a927ade 100644
--- a/tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c
+++ b/tools/testing/selftests/bpf/prog_tests/lsm_cgroup.c
@@ -173,10 +173,14 @@  static void test_lsm_cgroup_functional(void)
 	ASSERT_EQ(query_prog_cnt(cgroup_fd, NULL), 4, "total prog count");
 	ASSERT_EQ(query_prog_cnt(cgroup_fd2, NULL), 1, "total prog count");
 
-	/* AF_UNIX is prohibited. */
-
 	fd = socket(AF_UNIX, SOCK_STREAM, 0);
-	ASSERT_LT(fd, 0, "socket(AF_UNIX)");
+	if (skel->kconfig->CONFIG_SECURITY_APPARMOR
+	    || skel->kconfig->CONFIG_SECURITY_SELINUX
+	    || skel->kconfig->CONFIG_SECURITY_SMACK)
+		ASSERT_GE(fd, 0, "socket(AF_UNIX)");
+	else
+		/* AF_UNIX is prohibited. */
+		ASSERT_LT(fd, 0, "socket(AF_UNIX)");
 	close(fd);
 
 	/* AF_INET6 gets default policy (sk_priority). */
@@ -233,11 +237,18 @@  static void test_lsm_cgroup_functional(void)
 
 	/* AF_INET6+SOCK_STREAM
 	 * AF_PACKET+SOCK_RAW
+	 * AF_UNIX+SOCK_RAW if already have non-bpf lsms installed
 	 * listen_fd
 	 * client_fd
 	 * accepted_fd
 	 */
-	ASSERT_EQ(skel->bss->called_socket_post_create2, 5, "called_create2");
+	if (skel->kconfig->CONFIG_SECURITY_APPARMOR
+	    || skel->kconfig->CONFIG_SECURITY_SELINUX
+	    || skel->kconfig->CONFIG_SECURITY_SMACK)
+		/* AF_UNIX+SOCK_RAW if already have non-bpf lsms installed */
+		ASSERT_EQ(skel->bss->called_socket_post_create2, 6, "called_create2");
+	else
+		ASSERT_EQ(skel->bss->called_socket_post_create2, 5, "called_create2");
 
 	/* start_server
 	 * bind(ETH_P_ALL)
diff --git a/tools/testing/selftests/bpf/progs/lsm_cgroup.c b/tools/testing/selftests/bpf/progs/lsm_cgroup.c
index 4f2d60b..02c11d1 100644
--- a/tools/testing/selftests/bpf/progs/lsm_cgroup.c
+++ b/tools/testing/selftests/bpf/progs/lsm_cgroup.c
@@ -7,6 +7,10 @@ 
 
 char _license[] SEC("license") = "GPL";
 
+extern bool CONFIG_SECURITY_SELINUX __kconfig __weak;
+extern bool CONFIG_SECURITY_SMACK __kconfig __weak;
+extern bool CONFIG_SECURITY_APPARMOR __kconfig __weak;
+
 #ifndef AF_PACKET
 #define AF_PACKET 17
 #endif
@@ -140,6 +144,10 @@  int BPF_PROG(socket_bind2, struct socket *sock, struct sockaddr *address,
 int BPF_PROG(socket_alloc, struct sock *sk, int family, gfp_t priority)
 {
 	called_socket_alloc++;
+	/* if already have non-bpf lsms installed, EPERM will cause memory leak of non-bpf lsms */
+	if (CONFIG_SECURITY_SELINUX || CONFIG_SECURITY_SMACK || CONFIG_SECURITY_APPARMOR)
+		return 1;
+
 	if (family == AF_UNIX)
 		return 0; /* EPERM */