Hi, I'm using BPF_PROG_TEST_RUN to evaluate a BPF program which calls bpf_fib_lookup. While single-stepping through the function in gdb I got the following splat from the guest kernel: [ 137.718925] ============================= [ 137.721403] WARNING: suspicious RCU usage [ 137.723520] 5.7.0-rc2+ #82 Not tainted [ 137.725429] ----------------------------- [ 137.727502] include/net/neighbour.h:289 suspicious rcu_dereference_check() usage! [ 137.731669] [ 137.731669] other info that might help us debug this: [ 137.731669] [ 137.735401] [ 137.735401] rcu_scheduler_active = 2, debug_locks = 1 [ 137.737700] 1 lock held by redirect.test/2805: [ 137.739221] #0: ffffffff8267a560 (rcu_read_lock){....}-{1:2}, at: bpf_test_run+0x71/0x470 [ 137.741792] [ 137.741792] stack backtrace: [ 137.742992] CPU: 4 PID: 2805 Comm: redirect.test Not tainted 5.7.0-rc2+ #82 [ 137.744930] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 137.746829] Call Trace: [ 137.747271] dump_stack+0x71/0xa0 [ 137.747838] bpf_ipv4_fib_lookup+0x62a/0x900 [ 137.748545] bpf_skb_fib_lookup+0x66/0xa0 [ 137.749209] bpf_prog_09b9e47ddc527c6a_F+0x76/0x72c [ 137.750046] bpf_prog_a77b2b61316c22d2_F+0x13e4/0x1df4 [ 137.750859] ? lock_acquire+0xa0/0x360 [ 137.751406] ? bpf_test_run+0xc0/0x470 [ 137.751935] ? ktime_get+0xd2/0xf0 [ 137.752438] ? kvm_clock_get_cycles+0x14/0x20 [ 137.753348] ? ktime_get+0x7a/0xf0 [ 137.754413] bpf_test_run+0x175/0x470 [ 137.755645] ? kmem_cache_alloc+0x276/0x2a0 [ 137.756672] bpf_prog_test_run_skb+0x315/0x520 [ 137.757617] __do_sys_bpf+0x8f7/0x1d40 [ 137.758440] do_syscall_64+0x4b/0x1e0 [ 137.759233] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 137.760380] RIP: 0033:0x4b4f6b [ 137.761057] Code: ff e9 69 ff ff ff cc cc cc cc cc cc cc cc cc e8 2b aa f8 ff 48 8b 7c 24 10 48 8b 74 24 18 48 8b 54 24 20 48 8b 44 24 08 0f 05 <48> 3d 01 f0 ff ff 76 20 48 c7 44 24 28 ff ff ff ff 48 c7 44 24 30 [ 137.765025] RSP: 002b:000000c000129b50 EFLAGS: 00000206 ORIG_RAX: 0000000000000141 [ 137.766594] RAX: ffffffffffffffda RBX: 000000c000040000 RCX: 00000000004b4f6b [ 137.767661] RDX: 0000000000000028 RSI: 000000c000129c10 RDI: 000000000000000a [ 137.768718] RBP: 000000c000129b98 R08: 00000000009d5501 R09: 0000000000000001 [ 137.769749] R10: 000000c0002d0480 R11: 0000000000000206 R12: ffffffffffffffff [ 137.770806] R13: 0000000000000004 R14: 0000000000000003 R15: 0000000000000015 This happens on today's bpf-next. There is a comment in bpf_ipv4_fib_lookup: /* xdp and cls_bpf programs are run in RCU-bh so * rcu_read_lock_bh is not needed here */ Maybe this is not the case for BPF_PROG_TEST_RUN? Best Lorenz -- Lorenz Bauer | Systems Engineer 6th Floor, County Hall/The Riverside Building, SE1 7PB, UK www.cloudflare.com