Re: [PATCH] bpf: Release module BTF IDR before module unload

[Martin KaFai Lau <martin.lau@linux.dev>]

On 3/11/26 6:03 AM, Kumar Kartikeya Dwivedi wrote:
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---
>   kernel/bpf/btf.c | 15 ++++++++++++++-
>   1 file changed, 14 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 09fcbb125155..d18e218049ed 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -1883,10 +1883,17 @@ void btf_get(struct btf *btf)
>   	refcount_inc(&btf->refcnt);
>   }
>   
> +static bool btf_is_module(const struct btf *btf);
> +
>   void btf_put(struct btf *btf)
>   {
>   	if (btf && refcount_dec_and_test(&btf->refcnt)) {
> -		btf_free_id(btf);
> +		/*
> +		 * IDR for module BTFs is freed when module's BTF reference is
> +		 * dropped, which may happen before the final put.
> +		 */
> +		if (!btf_is_module(btf))
> +			btf_free_id(btf);
>   		call_rcu(&btf->rcu, btf_free_rcu);
>   	}
>   }
> @@ -8383,6 +8390,12 @@ static int btf_module_notify(struct notifier_block *nb, unsigned long op,
>   			if (btf_mod->module != module)
>   				continue;
>   
> +			/*
> +			 * For modules, we do the freeing of BTF IDR as soon as
> +			 * module goes away to disable BTF discovery, since the
> +			 * btf_try_get_module() on such BTFs will fail.
> +			 */
> +			btf_free_id(btf_mod->btf);
>   			list_del(&btf_mod->list);

The change makes sense.

I looked up a bit because I am interested in who will use the module's 
btf->id without holding the module's refcount. fwiw, here is what I read.

For non struct_ops prog, the module refcount is held in prog->aux->mod 
after commit 31bf1dbccfb0, so should be fine on the 
bpf_trampoline_compute_key() and bpf_prog_get_info_by_fd().

For struct_ops prog, the module refcount is not held in prog->aux->mod. 
I don't think it has to since it is not directly attached to the module. 
The only downside is the bpf_prog_get_info_by_fd() may report an 
out-dated info.attach_btf_obj_id. If it is an issue, maybe just hold the 
module refcount also.

For struct_ops map, it attaches the struct_ops prog to the module, so 
the module refcount is held. It should be fine.