On Wed, Oct 14, 2026 at 6:35 PM Qiliang Yuan <[email protected]> wrote: > > st_ops_assoc_in_timer_no_uref drops every reference to a struct_ops map > and expects a timer callback of its prog, 500ms later, to find no > struct_ops associated anymore. It fails now and then while test_progs > runs other tests in parallel, and v1 [1] made the test wait until the > association goes away. > > As the BPF CI bot pointed out on v1, the association goes away late > since commit 5db69b0fbdc8 ("bpf: Make struct_ops tasks_rcu grace period > optional"), which moved the RCU grace period of a struct_ops map in > front of clearing the association, so nothing waits for a prog that > reads the association in between. With that window widened, a timer > callback returns into a freed trampoline and the kernel hits an int3 > Oops. > > Patch 1 frees the map only after a grace period that follows clearing > the association, and patch 2 adds a test that catches a map freed under > a running .test_1. Patch 3 is v1 of the test fix, which can keep calling > through the association until it is cleared now that this is safe.
I think this fix is heading in the wrong direction. The struct_ops map association was designed as an RCU-protected pointer: asynchronous users may outlive the map and observe a NULL association. The existing selftest explicitly verifies this behavior. The problem is that the disassociation now happens after the grace period initiated by bpf_map_put(). Could we instead make disassociation safe in map_free_pre_rcu(), before that existing grace period, rather than adding another deferred-free path? > > [1] > https://lore.kernel.org/r/20261009-selftests-bpf-struct-ops-assoc-timer-v1-1-9a97a9b3d...@gmail.com > > Signed-off-by: Qiliang Yuan <[email protected]> > --- > V2 -> V3: > - Wait for an RCU tasks trace grace period in patch 1 for every map, so > that progs reading the association under RCU tasks trace, e.g. from a > bpf_wq callback, are waited for too (CI bot) > > V1 -> V2: > - Add patch 1, fixing the use-after-free behind the flaky test (CI bot) > - Add patch 2, a test for the use-after-free > - Point Fixes of patch 3 at 5db69b0fbdc8 (CI bot) > - Move the restarting of the timer into patch 2, which needs it too, > so patch 3 only turns it on for st_ops_assoc_in_timer_no_uref > - Rebase onto current bpf-next > > v2: > https://lore.kernel.org/r/20261010-selftests-bpf-struct-ops-assoc-timer-v2-0-d7a43896d...@gmail.com > v1: > https://lore.kernel.org/r/20261009-selftests-bpf-struct-ops-assoc-timer-v1-1-9a97a9b3d...@gmail.com > > --- > Qiliang Yuan (3): > bpf: Defer freeing a struct_ops map until its progs are done > selftests/bpf: Test freeing a struct_ops map under a running prog > selftests/bpf: Wait for the struct_ops map to be freed in assoc_in_timer > > kernel/bpf/bpf_struct_ops.c | 28 ++++++++++++++++++++- > .../bpf/prog_tests/test_struct_ops_assoc.c | 29 > +++++++++++++++++++--- > .../bpf/progs/struct_ops_assoc_in_timer.c | 16 ++++++++++++ > 3 files changed, 68 insertions(+), 5 deletions(-) > --- > base-commit: 15b578b1715d9a318c804350d98af87c203672bc > change-id: 20261009-selftests-bpf-struct-ops-assoc-timer-5eb0295ec300 > > Best regards, > -- > Qiliang Yuan <[email protected]> >
