[PATCH bpf-next v2 0/2] bpf: Invalidate RCU pointers after final spin unlock

[Ning Ding <dingning04@gmail.com>]

In a sleepable BPF program, a spin lock can provide the only RCU protection
for a kptr. The final spin unlock ends that protection, but the verifier
leaves the pointer valid. Another CPU can then free the object before the
pointer is used. A capability-limited runtime PoC triggered a
KASAN-confirmed task_struct use-after-free.

Patch 1 invalidates RCU-protected pointers only when an unlock leaves the
final RCU-protected context. Patch 2 adds a negative sleepable test and
positive controls for non-sleepable and explicit-RCU contexts.

Testing used fresh QEMU/KVM guests with KASAN enabled. The patched focused
test passed all three expected outcomes. The full task_kfunc test passed
all 39 subtests, and the selected RCU, refcount, and spin-lock group had no
failures.

---
v2:
  - Rebase onto bpf-next commit 60781269e26c.
  - Target bpf-next and split the fix from its selftests, as requested.
  - Add positive controls for RCU contexts that remain valid after unlock.

v1: https://lore.kernel.org/r/20260802231248.2781334-1-dingning04@gmail.com

Ning Ding (2):
  bpf: Invalidate RCU pointers after final spin unlock
  selftests/bpf: Test RCU pointer invalidation after spin unlock

 kernel/bpf/verifier.c                         |  5 ++
 .../selftests/bpf/prog_tests/task_kfunc.c     |  2 +
 .../selftests/bpf/progs/task_kfunc_common.h   | 12 +++++
 .../selftests/bpf/progs/task_kfunc_failure.c  | 24 ++++++++++
 .../selftests/bpf/progs/task_kfunc_success.c  | 48 +++++++++++++++++++
 5 files changed, 91 insertions(+)


base-commit: 60781269e26c786de2bb93fb1e697a5c32ccee48
-- 
2.43.0