st_ops_assoc_in_timer_no_uref runs .test_1, which starts a timer to call it again 500ms later, drops every reference to the struct_ops map, and expects the timer callback to find no struct_ops associated with its program anymore. The association goes away only when the last reference to the map is dropped. syscall_prog holds one through its own association and drops it only when it is freed, in a work item after an RCU tasks trace grace period. With other tests running in parallel, that can take longer than 500ms, and the callback still reaches the struct_ops and gets MAP_MAGIC instead of -1. Have the timer callback restart the timer until the map is gone, as it does for st_ops_assoc_in_timer_free. Calling the struct_ops through the association until then is safe, as the map is freed only after a grace period that follows clearing the association. st_ops_assoc_in_timer_no_uref run 100 times with test_progs -j32 running in the background, on a KASAN kernel with the fix, x86_64 VM with 32 vCPUs, before and after this patch: before after outcome 1 of 100 failed (MAP_MAGIC) 0 of 100 failed (MAP_MAGIC) Fixes: 0e841d19263a ("selftests/bpf: Test getting associated struct_ops in timer callback") Signed-off-by: Qiliang Yuan --- tools/testing/selftests/bpf/prog_tests/test_struct_ops_assoc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_assoc.c b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_assoc.c index 9d56e8cb5675a..435653cb7c908 100644 --- a/tools/testing/selftests/bpf/prog_tests/test_struct_ops_assoc.c +++ b/tools/testing/selftests/bpf/prog_tests/test_struct_ops_assoc.c @@ -187,7 +187,7 @@ static void run_st_ops_assoc_in_timer_no_uref(int timer_ns, int wait_map_free, static void test_st_ops_assoc_in_timer_no_uref(void) { - run_st_ops_assoc_in_timer_no_uref(500000000, 0, 0); + run_st_ops_assoc_in_timer_no_uref(500000000, 1, 0); } /* -- 2.43.0