[bpf-ci-bot] selftests/bpf: test_task_work_array_map fails intermittently in parallel mode

[kernel-patches-review-bot]

One-line summary

test_task_work/test_task_work_array_map fails in parallel test mode due to a race between repeated task work scheduling and process exit teardown ordering.

Test name(s) and mode(s)

• test_task_work/test_task_work_array_map in test_progs_parallel and test_progs_no_alu32_parallel

Failure signature

expected 'hello world', found '{U' in arrmap map
expected 'hello world', found '' in arrmap map

CI run references

• https://github.com/kernel-patches/bpf/actions/runs/23643032161 (test_progs_no_alu32_parallel)
• https://github.com/kernel-patches/bpf/actions/runs/23638827094 (test_progs_parallel + test_progs_no_alu32_parallel)

Root cause

The oncpu_array_map BPF program in tools/testing/selftests/bpf/progs/task_work.c lacks a guard against re-scheduling task work after the callback has already completed. Unlike the hash map handler (protected by BPF_NOEXIST) and the LRU map handler (which checks work->data[0]), the array map handler unconditionally re-schedules on every perf event.

The race window is:

1. Task work callback runs successfully, writes "hello world" to work->data, state returns to BPF_TW_STANDBY.
2. A subsequent perf event fires and re-schedules the same task work entry.
3. The child process calls exit(0). In do_exit(), the kernel calls:
   • perf_event_exit_task() at line 956 — stops generating perf events
   • exit_mm() at line 964 — sets current->mm = NULL
   • exit_task_work() at line 976 — runs any remaining queued task work
4. The re-queued task work callback executes after exit_mm() has set mm = NULL.
5. bpf_copy_from_user_str() → strncpy_from_user() fails because the address space is gone, leaving the map data corrupted or empty.

In parallel mode (-j), CPU contention increases the likelihood of this race by stretching timing windows between perf events and process exit.

Fix

Add work->data[0] check to oncpu_array_map(), matching the guard pattern used by oncpu_lru_map(). Once the callback has successfully written data, further re-scheduling is prevented.

-	if (!work)
+	if (!work || work->data[0])
 		return 0;

See attached patch: 0001-selftests-bpf-fix-task_work-array-map-race-in-parallel-mode.patch

Severity

Low — affects only parallel test mode; the test passes reliably in serial mode. The underlying bpf_task_work kernel infrastructure is correct; this is a test-only issue.

[kernel-patches-review-bot]

0001-selftests-bpf-fix-task_work-array-map-race-in-parallel-mode.patch

From: BPF CI Bot <bot+bpf-ci@kernel.org>
Subject: [PATCH] selftests/bpf: fix task_work array map race in parallel mode

The test_task_work_array_map subtest fails intermittently when run in
parallel mode (-j flag). The root cause is a race condition where
oncpu_array_map() repeatedly re-schedules task work after the callback
has already completed, because array map entries always exist and
there is no guard against re-scheduling.

When the child process exits, do_exit() calls perf_event_exit_task()
(which stops the perf events) before exit_mm() (which sets mm to
NULL). However, exit_task_work() runs after exit_mm(), so any task
work queued between the last perf event and perf_event_exit_task() may
execute its callback after mm is gone. At that point,
bpf_copy_from_user_str() calls strncpy_from_user() with a NULL mm,
which fails and either leaves stale data or writes partial/garbage
data into the map.

The hash map handler is protected by BPF_NOEXIST (the update fails
once the entry exists), and the LRU map handler explicitly checks
work->data[0] before scheduling. The array map handler lacks any
such guard.

Add a work->data[0] check to oncpu_array_map(), matching the pattern
used by oncpu_lru_map(). Once the callback has written data, further
scheduling is skipped, closing the race window.

Observed failures:
  - expected 'hello world', found '{U' (test_progs_no_alu32_parallel)
  - expected 'hello world', found '' (test_progs_parallel)

Generated-by: BPF CI Bot (claude-opus-4-6-v1) <bot+bpf-ci@kernel.org>
---
 tools/testing/selftests/bpf/progs/task_work.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/progs/task_work.c b/tools/testing/selftests/bpf/progs/task_work.c
index a6009d105158..1e47a57c7741 100644
--- a/tools/testing/selftests/bpf/progs/task_work.c
+++ b/tools/testing/selftests/bpf/progs/task_work.c
@@ -77,7 +77,7 @@ int oncpu_array_map(struct pt_regs *args)

 	task = bpf_get_current_task_btf();
 	work = bpf_map_lookup_elem(&arrmap, &key);
-	if (!work)
+	if (!work || work->data[0])
 		return 0;
 	bpf_task_work_schedule_signal(task, &work->tw, &arrmap, process_work);
 	return 0;
--
2.43.0