a delay in bpf_map_free_deferred() to delay map->ops->map_free(), which
significantly increased reproducibility.
- diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
- index 5e43ddd1b83f..aae5b5213e93 100644
- --- a/kernel/bpf/syscall.c
- +++ b/kernel/bpf/syscall.c
- @@ -695,6 +695,7 @@ static void bpf_map_free_deferred(struct work_struct *work)
- struct bpf_map *map = container_of(work, struct bpf_map, work);
- struct btf_record *rec = map->record;
-
- + mdelay(100);
- security_bpf_map_free(map);
- bpf_map_release_memcg(map);
- /* implementation dependent freeing */
+# diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+# index 5e43ddd1b83f..aae5b5213e93 100644
+# --- a/kernel/bpf/syscall.c
+# +++ b/kernel/bpf/syscall.c
+# @@ -695,6 +695,7 @@ static void bpf_map_free_deferred(struct work_struct *work)
+# struct bpf_map *map = container_of(work, struct bpf_map, work);
+# struct btf_record *rec = map->record;
+#
+# + mdelay(100);
+# security_bpf_map_free(map);
+# bpf_map_release_memcg(map);
+# /* implementation dependent freeing */
Hao also provided test cases ([1]) for easily reproducing the above issue.