> diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> index 77a81fa8ec6a..8c7add48e447 100644
> --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
[ ... ]
> +/* IRQ Work for HardIRQ context */
> +static void ctx_check_irq_fn(struct irq_work *work)
> +{
> + bpf_testmod_test_hardirq_fn();
> + tasklet_schedule(&ctx_check_tasklet);
> +}
[ ... ]
> @@ -1844,6 +1872,10 @@ static void bpf_testmod_exit(void)
> while (refcount_read(&prog_test_struct.cnt) > 1)
> msleep(20);
>
> + /* Clean up tasklet and irqwork */
> + tasklet_kill(&ctx_check_tasklet);
> + irq_work_sync(&ctx_check_irq);
Should the cleanup order be reversed here? The irq_work handler
ctx_check_irq_fn() calls tasklet_schedule(&ctx_check_tasklet). If the
irq_work is still pending when tasklet_kill() is called, the subsequent
irq_work_sync() may trigger the irq_work to run, which would then re-schedule
the already-killed tasklet.
This could lead to a use-after-free if the module unload completes while a
newly scheduled tasklet is still pending, since ctx_check_tasklet_fn() would
point to freed module code.
Would swapping these to call irq_work_sync() first ensure the irq_work cannot
schedule any more tasklets before tasklet_kill() runs?
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21280227502
