Re: [PATCH bpf-next v6 0/4] bpf: Fix a struct_ops use-after-free behind a flaky assoc_in_timer test

[Tejun Heo]

Hello,

The following is a Claude-generated review.

On Thu, Oct 22, 2026 at 04:48:35PM +0800, Qiliang Yuan wrote:
> grace period of bpf_map_put(), so nothing waits for a prog that reads
> the association in between.

sched_ext hits the same use-after-free. Its kfuncs find the scheduler
through bpf_prog_get_assoc_struct_ops() in scx_prog_sched(), from bpf_timer
callbacks too, such as central_timerfn() in scx_central. The series fixes
that as well.

5db69b0fbdc8 ("bpf: Make struct_ops tasks_rcu grace period optional") is in
the bpf-next-7.4 pull, so the bug lands in 7.4-rc1. Can the fix go through
bpf for 7.4-rc?

Thanks.

--
tejun