Re: [PATCH bpf-next v6 0/4] bpf: Fix a struct_ops use-after-free behind a flaky assoc_in_timer test

[Amery Hung]

On Thu, Oct 22, 2026 at 1:48 AM Qiliang Yuan <odys.yuan@xxxxxxxxx> wrote:
>
> st_ops_assoc_in_timer_no_uref drops every reference to a struct_ops map
> and expects a timer callback of its prog, 500ms later, to find no
> struct_ops associated anymore. It fails now and then while test_progs
> runs other tests in parallel.
>
> Since commit 5db69b0fbdc8 ("bpf: Make struct_ops tasks_rcu grace period
> optional"), a struct_ops map clears the association only after the RCU
> grace period of bpf_map_put(), so nothing waits for a prog that reads
> the association in between. A timer callback can then return into a
> freed trampoline, and the kernel hits an int3 Oops.
>
> Patch 1 lets the association be cleared in any context, and patch 2
> clears it in map_free_pre_rcu(), so that the grace period bpf_map_put()
> already waits for follows it. Patch 3 adds a test that catches a map
> freed under a running .test_1. Patch 4 has the timer callback of
> st_ops_assoc_in_timer_no_uref retry until the association is gone.
>
> Signed-off-by: Qiliang Yuan <odys.yuan@xxxxxxxxx>
> ---
> V5 -> V6:
> - Rebase onto current bpf-next
>
> V4 -> V5:
> - Drop the free_after_rcu_gp of struct_ops maps, which is dead now, and
>   update the comment of free_after_mult_rcu_gp in struct bpf_struct_ops
>   (Alexei)
> - Also stop the tests when associating syscall_prog fails (Sashiko)
>
> V3 -> V4:
> - Clear the association in map_free_pre_rcu() instead of deferring the
>   free of the map (Amery Hung)
> - Add patch 1, replacing st_ops_assoc_mutex with a spinlock, since
>   map_free_pre_rcu() may run in softirq
> - Stop st_ops_assoc_in_timer_free and _no_uref when running syscall_prog
>   fails, instead of waiting for the timer forever (Sashiko)
> - Point Fixes of patch 4 at 0e841d19263ab, which added the test, as the
>   delay left after patch 2 comes from freeing syscall_prog
>
> V2 -> V3:
> - Wait for an RCU tasks trace grace period in patch 1 for every map, so
>   that progs reading the association under RCU tasks trace, e.g. from a
>   bpf_wq callback, are waited for too (CI bot)
>
> V1 -> V2:
> - Add patch 1, fixing the use-after-free behind the flaky test (CI bot)
> - Add patch 2, a test for the use-after-free
> - Point Fixes of patch 3 at 5db69b0fbdc8 (CI bot)
> - Move the restarting of the timer into patch 2, which needs it too,
>   so patch 3 only turns it on for st_ops_assoc_in_timer_no_uref
> - Rebase onto current bpf-next
>
> v5: https://lore.kernel.org/r/20261019-selftests-bpf-struct-ops-assoc-timer-v5-0-77b2e181e5cc@xxxxxxxxx
> v4: https://lore.kernel.org/r/20261016-selftests-bpf-struct-ops-assoc-timer-v4-0-9ad31c21220c@xxxxxxxxx
> v3: https://lore.kernel.org/r/20261015-selftests-bpf-struct-ops-assoc-timer-v3-0-efe643d4b2a3@xxxxxxxxx
> v2: https://lore.kernel.org/r/20261010-selftests-bpf-struct-ops-assoc-timer-v2-0-d7a43896dbf1@xxxxxxxxx
> v1: https://lore.kernel.org/r/20261009-selftests-bpf-struct-ops-assoc-timer-v1-1-9a97a9b3d1db@xxxxxxxxx
>
> ---
> Qiliang Yuan (4):
>       bpf: Protect the struct_ops association with a spinlock
>       bpf: Dissociate struct_ops progs before the grace period of the map
>       selftests/bpf: Test freeing a struct_ops map under a running prog
>       selftests/bpf: Wait for the struct_ops map to be freed in assoc_in_timer
>

For the set

Reviewed-by: Amery Hung <ameryhung@xxxxxxxxx>