On Mon, Jun 23, 2025 at 8:13 PM Kumar Kartikeya Dwivedi
<memxor@xxxxxxxxx> wrote:
>
> Add a warning to ensure RCU lock is held around tree lookup, and then
> fix one of the invocations in bpf_stack_walker. The program has an
> active stack frame and won't disappear.
>
> Fixes: f18b03fabaa9 ("bpf: Implement BPF exceptions")
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx>
> ---
> kernel/bpf/core.c | 5 ++++-
> kernel/bpf/helpers.c | 2 ++
> 2 files changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 5c6e9fbb5508..b4203f68cf33 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -782,7 +782,10 @@ bool is_bpf_text_address(unsigned long addr)
>
> struct bpf_prog *bpf_prog_ksym_find(unsigned long addr)
> {
> - struct bpf_ksym *ksym = bpf_ksym_find(addr);
> + struct bpf_ksym *ksym;
> +
> + WARN_ON_ONCE(!rcu_read_lock_held());
> + ksym = bpf_ksym_find(addr);
>
> return ksym && ksym->prog ?
> container_of(ksym, struct bpf_prog_aux, ksym)->prog :
> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index 8fef7b3cbd80..61b69eb08c4a 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -2936,7 +2936,9 @@ static bool bpf_stack_walker(void *cookie, u64 ip, u64 sp, u64 bp)
>
> if (!is_bpf_text_address(ip))
> return !ctx->cnt;
> + rcu_read_lock();
> prog = bpf_prog_ksym_find(ip);
> + rcu_read_unlock();
Please add a comment here explaining that rcu lock protects
struct latch_tree_root bpf_tree access
and returned prog pointer won't disappear.
Otherwise the rcu lock usage looks highly suspicious.
