Re: [PATCH bpf-next v3 0/3] bpf: Fix a struct_ops use-after-free behind a flaky assoc_in_timer test

[Amery Hung]

On Wed, Oct 14, 2026 at 6:35 PM Qiliang Yuan <odys.yuan@xxxxxxxxx> wrote:
>
> st_ops_assoc_in_timer_no_uref drops every reference to a struct_ops map
> and expects a timer callback of its prog, 500ms later, to find no
> struct_ops associated anymore. It fails now and then while test_progs
> runs other tests in parallel, and v1 [1] made the test wait until the
> association goes away.
>
> As the BPF CI bot pointed out on v1, the association goes away late
> since commit 5db69b0fbdc8 ("bpf: Make struct_ops tasks_rcu grace period
> optional"), which moved the RCU grace period of a struct_ops map in
> front of clearing the association, so nothing waits for a prog that
> reads the association in between. With that window widened, a timer
> callback returns into a freed trampoline and the kernel hits an int3
> Oops.
>
> Patch 1 frees the map only after a grace period that follows clearing
> the association, and patch 2 adds a test that catches a map freed under
> a running .test_1. Patch 3 is v1 of the test fix, which can keep calling
> through the association until it is cleared now that this is safe.

I think this fix is heading in the wrong direction. The struct_ops map
association was designed as an RCU-protected pointer: asynchronous
users may outlive the map and observe a NULL association. The existing
selftest explicitly verifies this behavior.

The problem is that the disassociation now happens after the grace
period initiated by bpf_map_put(). Could we instead make
disassociation safe in map_free_pre_rcu(), before that existing grace
period, rather than adding another deferred-free path?

>
> [1] https://lore.kernel.org/r/20261009-selftests-bpf-struct-ops-assoc-timer-v1-1-9a97a9b3d1db@xxxxxxxxx
>
> Signed-off-by: Qiliang Yuan <odys.yuan@xxxxxxxxx>
> ---
> V2 -> V3:
> - Wait for an RCU tasks trace grace period in patch 1 for every map, so
>   that progs reading the association under RCU tasks trace, e.g. from a
>   bpf_wq callback, are waited for too (CI bot)
>
> V1 -> V2:
> - Add patch 1, fixing the use-after-free behind the flaky test (CI bot)
> - Add patch 2, a test for the use-after-free
> - Point Fixes of patch 3 at 5db69b0fbdc8 (CI bot)
> - Move the restarting of the timer into patch 2, which needs it too,
>   so patch 3 only turns it on for st_ops_assoc_in_timer_no_uref
> - Rebase onto current bpf-next
>
> v2: https://lore.kernel.org/r/20261010-selftests-bpf-struct-ops-assoc-timer-v2-0-d7a43896dbf1@xxxxxxxxx
> v1: https://lore.kernel.org/r/20261009-selftests-bpf-struct-ops-assoc-timer-v1-1-9a97a9b3d1db@xxxxxxxxx
>
> ---
> Qiliang Yuan (3):
>       bpf: Defer freeing a struct_ops map until its progs are done
>       selftests/bpf: Test freeing a struct_ops map under a running prog
>       selftests/bpf: Wait for the struct_ops map to be freed in assoc_in_timer
>
>  kernel/bpf/bpf_struct_ops.c                        | 28 ++++++++++++++++++++-
>  .../bpf/prog_tests/test_struct_ops_assoc.c         | 29 +++++++++++++++++++---
>  .../bpf/progs/struct_ops_assoc_in_timer.c          | 16 ++++++++++++
>  3 files changed, 68 insertions(+), 5 deletions(-)
> ---
> base-commit: 15b578b1715d9a318c804350d98af87c203672bc
> change-id: 20261009-selftests-bpf-struct-ops-assoc-timer-5eb0295ec300
>
> Best regards,
> --
> Qiliang Yuan <odys.yuan@xxxxxxxxx>
>