* Re: [PATCH bpf-next v6 0/4] bpf: Fix a struct_ops use-after-free behind a flaky assoc_in_timer test
[not found] <20261022-selftests-bpf-struct-ops-assoc-timer-v6-0-2c0f18e82582@gmail.com>
@ 2026-10-23 22:47 ` Tejun Heo
0 siblings, 0 replies; only message in thread
From: Tejun Heo @ 2026-10-23 22:47 UTC (permalink / raw)
To: Qiliang Yuan
Cc: Andrii Nakryiko, Eduard Zingerman, Ihor Solodrai,
Alexei Starovoitov, Daniel Borkmann, Kumar Kartikeya Dwivedi,
Martin KaFai Lau, Song Liu, Yonghong Song, Jiri Olsa,
Emil Tsalapatis, Shuah Khan, Amery Hung, bpf, linux-kselftest,
linux-kernel, sched-ext
Hello,
The following is a Claude-generated review.
On Thu, Oct 22, 2026 at 04:48:35PM +0800, Qiliang Yuan wrote:
> grace period of bpf_map_put(), so nothing waits for a prog that reads
> the association in between.
sched_ext hits the same use-after-free. Its kfuncs find the scheduler
through bpf_prog_get_assoc_struct_ops() in scx_prog_sched(), from bpf_timer
callbacks too, such as central_timerfn() in scx_central. The series fixes
that as well.
5db69b0fbdc8 ("bpf: Make struct_ops tasks_rcu grace period optional") is in
the bpf-next-7.4 pull, so the bug lands in 7.4-rc1. Can the fix go through
bpf for 7.4-rc?
Thanks.
--
tejun
^ permalink raw reply [flat|nested] only message in thread