Re: [PATCH bpf-next v2 0/2] bpf: Invalidate RCU pointers after final spin unlock

On Tue, Aug 04, 2026 at 11:50:10AM +0100, Puranjay Mohan wrote:
> Ning Ding <[email protected]> writes:
> 
> > In a sleepable BPF program, a spin lock can provide the only RCU protection
> > for a kptr. The final spin unlock ends that protection, but the verifier
> > leaves the pointer valid. Another CPU can then free the object before the
> > pointer is used. A capability-limited runtime PoC triggered a
> > KASAN-confirmed task_struct use-after-free.
> >
> > Patch 1 invalidates RCU-protected pointers only when an unlock leaves the
> > final RCU-protected context. Patch 2 adds a negative sleepable test and
> > positive controls for non-sleepable and explicit-RCU contexts.
> 
> I think if we are doing this we should do it for all things that act as
> an entry to a RCU read side critical section [1]:
> 
> 1. Disabling preemption
> 2. Disabling bottom halves
> 3. Disabling interrupts
> 4. Acquiring a spin lock
> 
> As you are doing it for 4, can you also do it for 1 and 3? I don't think
> BPF can disable bottom halves right now.
> 
> Paul, can you ack this? Let us know if there are more things that can
> make a BPF program enter a read side critical section.

This is quite true!

There is a range of complexity/capability here.  A set of partially
overlapping RCU read-side critical sections are implicitly "flattened"
into one long critical section covering the full set.  For example:

	spin_lock(&mylock); // starts RCU read-side critical section...
	local_irq_disable();
	spin_unlock(&mylock);
	preempt_disable();
	local_irq_enable();
	local_bh_disable();
	preempt_enable();
	local_bh_enable();  // ... and continues to here.

And rcutorture tests randomly chosen combinations up to eight segments
long.

So it is an interesting choice as to how much of this should be accounted
for by BPF.  Choose wisely!!!  ;-)

							Thanx, Paul

> Thanks,
> Puranjay
> 
> [1] https://docs.kernel.org/RCU/whatisRCU.html#:~:text=Note%20that%20anything,side%20critical%20sections.