st_ops_assoc_in_timer_no_uref drops every reference to a struct_ops map
and expects a timer callback of its prog, 500ms later, to find no
struct_ops associated anymore. It fails now and then while test_progs
runs other tests in parallel, and v1 [1] made the test wait until the
association goes away.
As the BPF CI bot pointed out on v1, the association goes away late
since commit 5db69b0fbdc8 ("bpf: Make struct_ops tasks_rcu grace period
optional"), which moved the RCU grace period of a struct_ops map in
front of clearing the association, so nothing waits for a prog that
reads the association in between. With that window widened, a timer
callback returns into a freed trampoline and the kernel hits an int3
Oops.
Patch 1 frees the map only after a grace period that follows clearing
the association, and patch 2 adds a test that catches a map freed under
a running .test_1. Patch 3 is v1 of the test fix, which can keep calling
through the association until it is cleared now that this is safe.
[1]
https://lore.kernel.org/r/20261009-selftests-bpf-struct-ops-assoc-timer-v1-1-9a97a9b3d...@gmail.com
Signed-off-by: Qiliang Yuan <[email protected]>
---
V1 -> V2:
- Add patch 1, fixing the use-after-free behind the flaky test (CI bot)
- Add patch 2, a test for the use-after-free
- Point Fixes of patch 3 at 5db69b0fbdc8 (CI bot)
- Move the restarting of the timer into patch 2, which needs it too,
so patch 3 only turns it on for st_ops_assoc_in_timer_no_uref
- Rebase onto current bpf-next
v1:
https://lore.kernel.org/r/20261009-selftests-bpf-struct-ops-assoc-timer-v1-1-9a97a9b3d...@gmail.com
---
Qiliang Yuan (3):
bpf: Defer freeing a struct_ops map until its progs are done
selftests/bpf: Test freeing a struct_ops map under a running prog
selftests/bpf: Wait for the struct_ops map to be freed in assoc_in_timer
kernel/bpf/bpf_struct_ops.c | 30 +++++++++++++++++++++-
.../bpf/prog_tests/test_struct_ops_assoc.c | 29 ++++++++++++++++++---
.../bpf/progs/struct_ops_assoc_in_timer.c | 16 ++++++++++++
3 files changed, 70 insertions(+), 5 deletions(-)
---
base-commit: 15b578b1715d9a318c804350d98af87c203672bc
change-id: 20261009-selftests-bpf-struct-ops-assoc-timer-5eb0295ec300
Best regards,
--
Qiliang Yuan <[email protected]>
