From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: "Qiliang Yuan" <odys.yuan@gmail.com>,
"Andrii Nakryiko" <andrii@kernel.org>,
"Eduard Zingerman" <eddyz87@gmail.com>,
"Ihor Solodrai" <ihor.solodrai@linux.dev>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Kumar Kartikeya Dwivedi" <memxor@gmail.com>,
"Martin KaFai Lau" <martin.lau@linux.dev>,
"Song Liu" <song@kernel.org>,
"Yonghong Song" <yonghong.song@linux.dev>,
"Jiri Olsa" <jolsa@kernel.org>,
"Emil Tsalapatis" <emil@etsalapatis.com>,
"Shuah Khan" <shuah@kernel.org>,
"Amery Hung" <ameryhung@gmail.com>
Cc: <bpf@vger.kernel.org>, <linux-kselftest@vger.kernel.org>,
<linux-kernel@vger.kernel.org>
Subject: Re: [PATCH bpf-next v4 2/4] bpf: Dissociate struct_ops progs before the grace period of the map
Date: Fri, 16 Oct 2026 19:06:22 +0000 [thread overview]
Message-ID: <DM6HXJLRTM4D.H1WFBHSKIH2W@gmail.com> (raw)
In-Reply-To: <20261016-selftests-bpf-struct-ops-assoc-timer-v4-2-9ad31c21220c@gmail.com>
On Fri, Oct 16, 2026 at 10:59 AM Qiliang Yuan <odys.yuan@gmail.com> wrote:
> - map->free_after_mult_rcu_gp = st_ops_desc->st_ops->free_after_mult_rcu_gp;
> + /*
> + * A prog dissociated in map_free_pre_rcu() may still run the struct_ops
> + * from a bpf_wq callback or a sleepable prog, under RCU tasks trace.
> + */
> + map->free_after_mult_rcu_gp = true;
> map->free_after_rcu_gp = true;
In v3 thread you asked whether to leave it to each struct_ops.
No. The owner of struct_ops cannot know whether a non-sleepable prog
starts bpf_wq.
bpf_map_put() checks free_after_mult_rcu_gp first,
so free_after_rcu_gp = true is dead now. Drop it.
st_ops->free_after_mult_rcu_gp only picks the gp for cgroup prog array
after this patch. Update its comment in struct bpf_struct_ops.
pw-bot: cr
next prev parent reply other threads:[~2026-10-16 19:06 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-16 2:59 [PATCH bpf-next v4 0/4] bpf: Fix a struct_ops use-after-free behind a flaky assoc_in_timer test Qiliang Yuan
2026-10-16 2:59 ` [PATCH bpf-next v4 1/4] bpf: Protect the struct_ops association with a spinlock Qiliang Yuan
2026-10-16 2:59 ` [PATCH bpf-next v4 2/4] bpf: Dissociate struct_ops progs before the grace period of the map Qiliang Yuan
2026-10-16 19:06 ` Alexei Starovoitov [this message]
2026-10-16 2:59 ` [PATCH bpf-next v4 3/4] selftests/bpf: Test freeing a struct_ops map under a running prog Qiliang Yuan
2026-10-16 3:11 ` sashiko-bot
2026-10-16 2:59 ` [PATCH bpf-next v4 4/4] selftests/bpf: Wait for the struct_ops map to be freed in assoc_in_timer Qiliang Yuan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DM6HXJLRTM4D.H1WFBHSKIH2W@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=odys.yuan@gmail.com \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.