Re: [PATCH bpf v5 1/3] bpf: Wait for an RCU tasks grace period before freeing trampoline progs

[sashiko-bot@kernel.org]

> When a prog is detached from a trampoline, it is freed after an RCU
> grace period, or an RCU tasks trace one if it is sleepable. This covers
> the tasks that are running the prog, since the prog's enter helper takes
> the matching read lock before the prog is called. On a preemptible
> kernel, it doesn't cover a task that was preempted in the trampoline
> just before the enter helper. That task holds no lock yet, and it calls
> the prog after it was freed:
> 
>   BUG: KASAN: vmalloc-out-of-bounds in __bpf_prog_enter_recur+0x3a5/0x3f0
>   Read of size 8 at addr ffffc90000055040 by task candidate/110
>   CPU: 1 UID: 0 PID: 110 Comm: candidate Not tainted 7.3.0-rc2-00014-g15071f2a1263-dirty #2 PREEMPT(full)
>   Call Trace:
>    <TASK>
>    __bpf_prog_enter_recur+0x3a5/0x3f0
>    bpf_trampoline_6442509193+0x37/0xf1
> [ ... ]
> Fixes: e21aa341785c ("bpf: Fix fexit trampoline.")
> Reported-by: Junseo Lim <zirajs7@gmail.com>
> Closes: https://lore.kernel.org/bpf/aqdrwVpanH3WGurX@omen-arch/
> Assisted-by: Claude:unspecified
> Signed-off-by: Florent Revest (Anthropic) <florent.revest@linux.dev>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926135605.1217928-1-florent.revest@linux.dev?part=1