* [PATCH bpf] bpf: move security_bpf_prog_free() out of RCU callback
@ 2026-06-26 9:37 Sechang Lim
2026-06-30 23:17 ` Alexei Starovoitov
0 siblings, 1 reply; 3+ messages in thread
From: Sechang Lim @ 2026-06-26 9:37 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko
Cc: Paul Moore, John Fastabend, Martin KaFai Lau, Eduard Zingerman,
Kumar Kartikeya Dwivedi, Song Liu, Yonghong Song, Jiri Olsa, bpf,
linux-kernel
__bpf_prog_put_rcu() is the call_rcu() callback for non-sleepable programs.
security_bpf_prog_free() called from there fires bpf_prog_free in softirq;
if a sleepable LSM prog is attached to that hook, might_fault() BUGs:
BUG: sleeping function called from invalid context
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5038
preempt_count: 101, expected: 0
Call Trace:
<IRQ>
__bpf_prog_enter_sleepable+0x1cd/0x320 kernel/bpf/trampoline.c:1255
bpf_trampoline_6442549705+0x53/0xd7
security_bpf_prog_free+0xde/0x130 security/security.c:5465
__bpf_prog_put_rcu+0xab/0xd0 kernel/bpf/syscall.c:2365
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
handle_softirqs+0x236/0x800 kernel/softirq.c:622
</IRQ>
The call_rcu/call_rcu_tasks_trace split reflects the freed program's
sleepability, not that of any attached observer.
Move security_bpf_prog_free() to __bpf_prog_put_noref() before the RCU
deferral.
Fixes: 1b67772e4e3f ("bpf,lsm: Refactor bpf_prog_alloc/bpf_prog_free LSM hooks")
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
---
kernel/bpf/syscall.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 630d530782fe..f14c3f0f8827 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2362,7 +2362,6 @@ static void __bpf_prog_put_rcu(struct rcu_head *rcu)
kvfree(aux->func_info);
kfree(aux->func_info_aux);
free_uid(aux->user);
- security_bpf_prog_free(aux->prog);
bpf_prog_free(aux->prog);
}
@@ -2378,6 +2377,7 @@ static void __bpf_prog_put_noref(struct bpf_prog *prog, bool deferred)
if (prog->aux->attach_btf)
btf_put(prog->aux->attach_btf);
+ security_bpf_prog_free(prog);
if (deferred) {
if (prog->sleepable)
call_rcu_tasks_trace(&prog->aux->rcu, __bpf_prog_put_rcu);
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH bpf] bpf: move security_bpf_prog_free() out of RCU callback
2026-06-26 9:37 [PATCH bpf] bpf: move security_bpf_prog_free() out of RCU callback Sechang Lim
@ 2026-06-30 23:17 ` Alexei Starovoitov
2026-07-01 8:05 ` Sechang Lim
0 siblings, 1 reply; 3+ messages in thread
From: Alexei Starovoitov @ 2026-06-30 23:17 UTC (permalink / raw)
To: Sechang Lim, Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko
Cc: Paul Moore, John Fastabend, Martin KaFai Lau, Eduard Zingerman,
Kumar Kartikeya Dwivedi, Song Liu, Yonghong Song, Jiri Olsa, bpf,
linux-kernel
On Fri Jun 26, 2026 at 2:37 AM PDT, Sechang Lim wrote:
> __bpf_prog_put_rcu() is the call_rcu() callback for non-sleepable programs.
> security_bpf_prog_free() called from there fires bpf_prog_free in softirq;
> if a sleepable LSM prog is attached to that hook, might_fault() BUGs:
>
> BUG: sleeping function called from invalid context
> in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5038
> preempt_count: 101, expected: 0
> Call Trace:
> <IRQ>
> __bpf_prog_enter_sleepable+0x1cd/0x320 kernel/bpf/trampoline.c:1255
> bpf_trampoline_6442549705+0x53/0xd7
> security_bpf_prog_free+0xde/0x130 security/security.c:5465
> __bpf_prog_put_rcu+0xab/0xd0 kernel/bpf/syscall.c:2365
> rcu_do_batch kernel/rcu/tree.c:2617 [inline]
> handle_softirqs+0x236/0x800 kernel/softirq.c:622
> </IRQ>
>
> The call_rcu/call_rcu_tasks_trace split reflects the freed program's
> sleepability, not that of any attached observer.
>
> Move security_bpf_prog_free() to __bpf_prog_put_noref() before the RCU
> deferral.
>
> Fixes: 1b67772e4e3f ("bpf,lsm: Refactor bpf_prog_alloc/bpf_prog_free LSM hooks")
> Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
> ---
> kernel/bpf/syscall.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 630d530782fe..f14c3f0f8827 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -2362,7 +2362,6 @@ static void __bpf_prog_put_rcu(struct rcu_head *rcu)
> kvfree(aux->func_info);
> kfree(aux->func_info_aux);
> free_uid(aux->user);
> - security_bpf_prog_free(aux->prog);
> bpf_prog_free(aux->prog);
> }
>
> @@ -2378,6 +2377,7 @@ static void __bpf_prog_put_noref(struct bpf_prog *prog, bool deferred)
> if (prog->aux->attach_btf)
> btf_put(prog->aux->attach_btf);
>
> + security_bpf_prog_free(prog);
I don't think you can just move it like that, since LSM side
may rely on RCU GP.
I think removing security_bpf_prog_free from sleepable is cleaner.
pw-bot: cr
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH bpf] bpf: move security_bpf_prog_free() out of RCU callback
2026-06-30 23:17 ` Alexei Starovoitov
@ 2026-07-01 8:05 ` Sechang Lim
0 siblings, 0 replies; 3+ messages in thread
From: Sechang Lim @ 2026-07-01 8:05 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Paul Moore,
John Fastabend, Martin KaFai Lau, Eduard Zingerman,
Kumar Kartikeya Dwivedi, Song Liu, Yonghong Song, Jiri Olsa, bpf,
linux-kernel
On Tue, Jun 30, 2026 at 04:17:26PM -0700, Alexei Starovoitov wrote:
>On Fri Jun 26, 2026 at 2:37 AM PDT, Sechang Lim wrote:
>> __bpf_prog_put_rcu() is the call_rcu() callback for non-sleepable programs.
>> security_bpf_prog_free() called from there fires bpf_prog_free in softirq;
>> if a sleepable LSM prog is attached to that hook, might_fault() BUGs:
>>
>> BUG: sleeping function called from invalid context
>> in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5038
>> preempt_count: 101, expected: 0
>> Call Trace:
>> <IRQ>
>> __bpf_prog_enter_sleepable+0x1cd/0x320 kernel/bpf/trampoline.c:1255
>> bpf_trampoline_6442549705+0x53/0xd7
>> security_bpf_prog_free+0xde/0x130 security/security.c:5465
>> __bpf_prog_put_rcu+0xab/0xd0 kernel/bpf/syscall.c:2365
>> rcu_do_batch kernel/rcu/tree.c:2617 [inline]
>> handle_softirqs+0x236/0x800 kernel/softirq.c:622
>> </IRQ>
>>
>> The call_rcu/call_rcu_tasks_trace split reflects the freed program's
>> sleepability, not that of any attached observer.
>>
>> Move security_bpf_prog_free() to __bpf_prog_put_noref() before the RCU
>> deferral.
>>
>> Fixes: 1b67772e4e3f ("bpf,lsm: Refactor bpf_prog_alloc/bpf_prog_free LSM hooks")
>> Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
>> ---
>> kernel/bpf/syscall.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
>> index 630d530782fe..f14c3f0f8827 100644
>> --- a/kernel/bpf/syscall.c
>> +++ b/kernel/bpf/syscall.c
>> @@ -2362,7 +2362,6 @@ static void __bpf_prog_put_rcu(struct rcu_head *rcu)
>> kvfree(aux->func_info);
>> kfree(aux->func_info_aux);
>> free_uid(aux->user);
>> - security_bpf_prog_free(aux->prog);
>> bpf_prog_free(aux->prog);
>> }
>>
>> @@ -2378,6 +2377,7 @@ static void __bpf_prog_put_noref(struct bpf_prog *prog, bool deferred)
>> if (prog->aux->attach_btf)
>> btf_put(prog->aux->attach_btf);
>>
>> + security_bpf_prog_free(prog);
>
>I don't think you can just move it like that, since LSM side
>may rely on RCU GP.
>I think removing security_bpf_prog_free from sleepable is cleaner.
>
Ah, that sounds right. Will fix in v2.
Thanks!
Bests,
Sechang
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-01 8:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-26 9:37 [PATCH bpf] bpf: move security_bpf_prog_free() out of RCU callback Sechang Lim
2026-06-30 23:17 ` Alexei Starovoitov
2026-07-01 8:05 ` Sechang Lim
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox