Re: [PATCH bpf-next v6 0/4] bpf: Fix a struct_ops use-after-free behind a flaky assoc_in_timer test

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@xxxxxxxxxx>:

On Thu, 22 Oct 2026 16:48:35 +0800 you wrote:
> st_ops_assoc_in_timer_no_uref drops every reference to a struct_ops map
> and expects a timer callback of its prog, 500ms later, to find no
> struct_ops associated anymore. It fails now and then while test_progs
> runs other tests in parallel.
> 
> Since commit 5db69b0fbdc8 ("bpf: Make struct_ops tasks_rcu grace period
> optional"), a struct_ops map clears the association only after the RCU
> grace period of bpf_map_put(), so nothing waits for a prog that reads
> the association in between. A timer callback can then return into a
> freed trampoline, and the kernel hits an int3 Oops.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v6,1/4] bpf: Protect the struct_ops association with a spinlock
    https://git.kernel.org/bpf/bpf/c/232475c32994
  - [bpf-next,v6,2/4] bpf: Dissociate struct_ops progs before the grace period of the map
    https://git.kernel.org/bpf/bpf/c/377ab5f2ef79
  - [bpf-next,v6,3/4] selftests/bpf: Test freeing a struct_ops map under a running prog
    https://git.kernel.org/bpf/bpf/c/a451867eb5f6
  - [bpf-next,v6,4/4] selftests/bpf: Wait for the struct_ops map to be freed in assoc_in_timer
    https://git.kernel.org/bpf/bpf/c/ac3df711a428

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html