Are bpf_probe_read functions etc, atomic ? And do they inc ref counts of the data structure they're are reading, because if the operation is not atomic while the read is going through the kernel deallocates that data structure can it not cause a kernel panic (SEG FAULT).
Did not find the defintion of bpf_probe_read so could not confirm the same on my own.
Atomic is perhaps not the the correct term since, as far as I can tell there is no memory locking, so it would technically be possible that memory is modified while you are reading it.
But the bpf_probe_read for kernel memory is implemented using the copy_from_kernel_nofault function which disables page faults while reading, so the kernel will not panic or get a seg fault.
