On Fri, Oct 9, 2026 at 02:36 AM [email protected] wrote: > Should the late dissociation be fixed in bpf_struct_ops_map_free() instead > of only making the test wait longer, for example with a grace period after > bpf_struct_ops_map_dissoc_progs() or by dissociating before the call_rcu()? > > If the flakiness started with 5db69b0fbdc8, is the Fixes: tag pointing at > the right commit?
Yes to both. With the window widened, a timer callback of the struct_ops prog returns into the freed trampoline and the kernel hits an int3 Oops, on the first run. v2 [1] frees the map after a grace period that follows clearing the association, since dissociating before the call_rcu() would take a mutex where bpf_map_put() may run in softirq. It adds a test that catches the map being freed under a running .test_1, and keeps the test fix of v1 with Fixes pointing at 5db69b0fbdc8. [1] https://lore.kernel.org/r/20261010-selftests-bpf-struct-ops-assoc-timer-v2-0-d7a43896d...@gmail.com Thanks, Qiliang
