Commit 6905f8601298 ("bpf: Allow special fields in resizable hashtab") says
that "kptr semantics under in-place updates are identical to array map."
However, RHash calls bpf_obj_free_fields() after copy_map_value(), dropping
the kptr that the copy preserves.Use bpf_obj_cancel_fields() in the update and deferred deletion paths, as hash and array maps do. It cancels timer, workqueue, and task-work state while the allocator destructor releases kptrs at final reclamation. Add a selftest that verifies a task kptr survives a BPF_EXIST update and exercises delayed deletion. Signed-off-by: Nuoqi Gui <[email protected]> --- Nuoqi Gui (2): bpf: Cancel RHash special fields on value recycle selftests/bpf: Cover RHash special-field recycle kernel/bpf/hashtab.c | 14 ++--- tools/testing/selftests/bpf/prog_tests/rhash.c | 3 + tools/testing/selftests/bpf/progs/rhash.c | 81 ++++++++++++++++++++++++++ 3 files changed, 91 insertions(+), 7 deletions(-) --- base-commit: a23a71823352e2d792dcaae25f1ebb744acbfc0b change-id: 20260722-f01-23-rhash-cancel-bpf-next-02a6e7ec115e Best regards, -- Nuoqi Gui <[email protected]>
