Re: [PATCH bpf] bpf: move security_bpf_prog_free() out of RCU callback

[Sechang Lim <rhkrqnwk98@gmail.com>]

On Tue, Jun 30, 2026 at 04:17:26PM -0700, Alexei Starovoitov wrote:
>On Fri Jun 26, 2026 at 2:37 AM PDT, Sechang Lim wrote:
>> __bpf_prog_put_rcu() is the call_rcu() callback for non-sleepable programs.
>> security_bpf_prog_free() called from there fires bpf_prog_free in softirq;
>> if a sleepable LSM prog is attached to that hook, might_fault() BUGs:
>>
>>   BUG: sleeping function called from invalid context
>>   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5038
>>   preempt_count: 101, expected: 0
>>   Call Trace:
>>    <IRQ>
>>    __bpf_prog_enter_sleepable+0x1cd/0x320 kernel/bpf/trampoline.c:1255
>>    bpf_trampoline_6442549705+0x53/0xd7
>>    security_bpf_prog_free+0xde/0x130 security/security.c:5465
>>    __bpf_prog_put_rcu+0xab/0xd0 kernel/bpf/syscall.c:2365
>>    rcu_do_batch kernel/rcu/tree.c:2617 [inline]
>>    handle_softirqs+0x236/0x800 kernel/softirq.c:622
>>    </IRQ>
>>
>> The call_rcu/call_rcu_tasks_trace split reflects the freed program's
>> sleepability, not that of any attached observer.
>>
>> Move security_bpf_prog_free() to __bpf_prog_put_noref() before the RCU
>> deferral.
>>
>> Fixes: 1b67772e4e3f ("bpf,lsm: Refactor bpf_prog_alloc/bpf_prog_free LSM hooks")
>> Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
>> ---
>>  kernel/bpf/syscall.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
>> index 630d530782fe..f14c3f0f8827 100644
>> --- a/kernel/bpf/syscall.c
>> +++ b/kernel/bpf/syscall.c
>> @@ -2362,7 +2362,6 @@ static void __bpf_prog_put_rcu(struct rcu_head *rcu)
>>  	kvfree(aux->func_info);
>>  	kfree(aux->func_info_aux);
>>  	free_uid(aux->user);
>> -	security_bpf_prog_free(aux->prog);
>>  	bpf_prog_free(aux->prog);
>>  }
>>
>> @@ -2378,6 +2377,7 @@ static void __bpf_prog_put_noref(struct bpf_prog *prog, bool deferred)
>>  	if (prog->aux->attach_btf)
>>  		btf_put(prog->aux->attach_btf);
>>
>> +	security_bpf_prog_free(prog);
>
>I don't think you can just move it like that, since LSM side
>may rely on RCU GP.
>I think removing security_bpf_prog_free from sleepable is cleaner.
>

Ah, that sounds right. Will fix in v2.
Thanks!

Bests,
Sechang