Re: [PATCH v1 bpf] bpf: Free reuseport cBPF prog after RCU grace period.

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [Low] Function signature mismatch causing a build failure and an unused parameter.
--

commit 6107cbce59856b0c337016870577c881817dea05
Author: Kuniyuki Iwashima <kuniyu@google.com>

bpf: Free reuseport cBPF prog after RCU grace period.

This commit defers freeing of reuseport cBPF programs until after an RCU
grace period to avoid use-after-free bugs when they are detached while
packets are being sent. It uses call_rcu to handle the deferred cleanup.

> diff --git a/net/core/filter.c b/net/core/filter.c
> index 5fa9189eb772b2..5b6bd26bb80a92 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c

[ ... ]

> -void sk_reuseport_prog_free(struct bpf_prog *prog)
> +void sk_reuseport_prog_free(struct bpf_prog *prog, bool wait_rcu)
>  {

Does this change the function signature without updating the declaration in
include/linux/filter.h or the callers in net/core/sock_reuseport.c? This
appears to cause a build failure due to conflicting types and too few
arguments passed by existing callers.

>  	if (!prog)
>  		return;
>  
> -	if (prog->type == BPF_PROG_TYPE_SK_REUSEPORT)
> -		bpf_prog_put(prog);
> +	if (bpf_prog_was_classic(prog))
> +		call_rcu(&prog->aux->rcu, sk_reuseport_prog_free_rcu);

Is the new wait_rcu parameter used? It looks like call_rcu is executed
unconditionally for classic BPF programs, and wait_rcu is ignored
throughout the function body.

>  	else
> -		bpf_prog_destroy(prog);
> +		bpf_prog_put(prog);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260424235247.1990272-1-kuniyu@google.com?part=1