Re: [PATCH bpf] bpf: move security_bpf_prog_free() out of RCU callback

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch fails to fix the `BUG: sleeping function called from invalid context` because `security_bpf_prog_free()` can still execute synchronously in softirq contexts.
- [High] Use-After-Free on `prog->aux` fields when traversing the `bpf_prog` structure in the `bpf_prog_free` LSM hook.
--

commit ce00646a70b27dcf100e6bb9652d3943185fcac5
Author: Sechang Lim <rhkrqnwk98@gmail.com>

bpf: move security_bpf_prog_free() out of RCU callback

This commit moves security_bpf_prog_free() from __bpf_prog_put_rcu() to
__bpf_prog_put_noref() before the RCU deferral. This change is intended
to prevent a BUG caused by sleeping LSM BPF programs executing in atomic
context when attached to the bpf_prog_free hook.

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 6db306d23b479..6d9a662241159 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c

[ ... ]

> @@ -2457,6 +2456,7 @@ static void __bpf_prog_put_noref(struct bpf_prog *prog, bool deferred)
>  	if (prog->aux->attach_btf)
>  		btf_put(prog->aux->attach_btf);
>  
> +	security_bpf_prog_free(prog);

[Severity: High]
This is a pre-existing issue, but does moving this hook here expose a
use-after-free read if an attached LSM BPF program traverses the
bpf_prog structure?

The hook is invoked after several dynamically allocated fields in prog->aux
(such as linfo, jited_linfo, and kfunc_tab) have been freed earlier in
__bpf_prog_put_noref() via kvfree() and kfree(). An LSM BPF
program attached to bpf_prog_free could read these dangling pointers.

[Severity: High]
This isn't a bug introduced by this patch, but will this placement actually
resolve the "sleeping function called from invalid context" BUG?

If a program refcount is dropped from an RCU softirq path, such as in
__dev_map_entry_free() in kernel/bpf/devmap.c, it appears we still reach this
hook synchronously in atomic context:

kernel/bpf/syscall.c:__bpf_prog_put() {
    ...
	if (in_hardirq() || irqs_disabled()) {
		INIT_WORK(&aux->work, bpf_prog_put_deferred);
		schedule_work(&aux->work);
	} else {
		bpf_prog_put_deferred(&aux->work);
	}
}

Because in_hardirq() and irqs_disabled() are both false in softirq context,
bpf_prog_put_deferred() and consequently __bpf_prog_put_noref() will execute
synchronously, firing the LSM hook and hitting the same BUG.

>  	if (deferred) {
>  		if (prog->sleepable)
>  			call_rcu_tasks_trace(&prog->aux->rcu, __bpf_prog_put_rcu);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260626093711.2969648-1-rhkrqnwk98@gmail.com?part=1