linux-kernel - Re: [PATCH bpf-next v1 2/2] selftests/bpf: Add tests for execution context kfuncs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <109e6caa10a260b0f02b2595fb021db560daf0b77e9b3d1db61ee57191d6fd25@mail.kernel.org>
Date: Fri, 23 Jan 2026 09:08:07 +0000 (UTC)
From: bot+bpf-ci@...nel.org
To: changwoo@...lia.com,ast@...nel.org,daniel@...earbox.net,andrii@...nel.org
Cc: martin.lau@...ux.dev,eddyz87@...il.com,song@...nel.org,yonghong.song@...ux.dev,john.fastabend@...il.com,kpsingh@...nel.org,sdf@...ichev.me,haoluo@...gle.com,jolsa@...nel.org,shuah@...nel.org,kernel-dev@...lia.com,bpf@...r.kernel.org,sched-ext@...ts.linux.dev,linux-kernel@...r.kernel.org,linux-kselftest@...r.kernel.org,changwoo@...lia.com,ast@...nel.org,andrii@...nel.org,daniel@...earbox.net,martin.lau@...nel.org,eddyz87@...il.com,yonghong.song@...ux.dev,clm@...a.com,ihor.solodrai@...ux.dev
Subject: Re: [PATCH bpf-next v1 2/2] selftests/bpf: Add tests for execution context kfuncs

> diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> index 77a81fa8ec6a..8c7add48e447 100644
> --- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
> +++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c

[ ... ]

> +/* IRQ Work for HardIRQ context */
> +static void ctx_check_irq_fn(struct irq_work *work)
> +{
> +	bpf_testmod_test_hardirq_fn();
> +	tasklet_schedule(&ctx_check_tasklet);
> +}

[ ... ]

> @@ -1844,6 +1872,10 @@ static void bpf_testmod_exit(void)
>  	while (refcount_read(&prog_test_struct.cnt) > 1)
>  		msleep(20);
>
> +	/* Clean up tasklet and irqwork */
> +	tasklet_kill(&ctx_check_tasklet);
> +	irq_work_sync(&ctx_check_irq);

Should the cleanup order be reversed here? The irq_work handler
ctx_check_irq_fn() calls tasklet_schedule(&ctx_check_tasklet). If the
irq_work is still pending when tasklet_kill() is called, the subsequent
irq_work_sync() may trigger the irq_work to run, which would then re-schedule
the already-killed tasklet.

This could lead to a use-after-free if the module unload completes while a
newly scheduled tasklet is still pending, since ctx_check_tasklet_fn() would
point to freed module code.

Would swapping these to call irq_work_sync() first ensure the irq_work cannot
schedule any more tasklets before tasklet_kill() runs?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21280227502