Re: [PATCH bpf] bpf: move security_bpf_prog_free() out of RCU callback

[Alexei Starovoitov]

On Fri Jun 26, 2026 at 2:37 AM PDT, Sechang Lim wrote:
> __bpf_prog_put_rcu() is the call_rcu() callback for non-sleepable programs.
> security_bpf_prog_free() called from there fires bpf_prog_free in softirq;
> if a sleepable LSM prog is attached to that hook, might_fault() BUGs:
>
>   BUG: sleeping function called from invalid context
>   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5038
>   preempt_count: 101, expected: 0
>   Call Trace:
>    <IRQ>
>    __bpf_prog_enter_sleepable+0x1cd/0x320 kernel/bpf/trampoline.c:1255
>    bpf_trampoline_6442549705+0x53/0xd7
>    security_bpf_prog_free+0xde/0x130 security/security.c:5465
>    __bpf_prog_put_rcu+0xab/0xd0 kernel/bpf/syscall.c:2365
>    rcu_do_batch kernel/rcu/tree.c:2617 [inline]
>    handle_softirqs+0x236/0x800 kernel/softirq.c:622
>    </IRQ>
>
> The call_rcu/call_rcu_tasks_trace split reflects the freed program's
> sleepability, not that of any attached observer.
>
> Move security_bpf_prog_free() to __bpf_prog_put_noref() before the RCU
> deferral.
>
> Fixes: 1b67772e4e3f ("bpf,lsm: Refactor bpf_prog_alloc/bpf_prog_free LSM hooks")
> Signed-off-by: Sechang Lim <rhkrqnwk98@xxxxxxxxx>
> ---
>  kernel/bpf/syscall.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 630d530782fe..f14c3f0f8827 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -2362,7 +2362,6 @@ static void __bpf_prog_put_rcu(struct rcu_head *rcu)
>  	kvfree(aux->func_info);
>  	kfree(aux->func_info_aux);
>  	free_uid(aux->user);
> -	security_bpf_prog_free(aux->prog);
>  	bpf_prog_free(aux->prog);
>  }
>  
> @@ -2378,6 +2377,7 @@ static void __bpf_prog_put_noref(struct bpf_prog *prog, bool deferred)
>  	if (prog->aux->attach_btf)
>  		btf_put(prog->aux->attach_btf);
>  
> +	security_bpf_prog_free(prog);

I don't think you can just move it like that, since LSM side
may rely on RCU GP.
I think removing security_bpf_prog_free from sleepable is cleaner.

pw-bot: cr