bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()
de020dc8 · Ömer Mete Kaya <[email protected]> · 2026-09-29 11:10:34 +03:00
bpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration
to be disabled. All callers of rhtab_delete_elem() disable migration
except __rhtab_map_lookup_and_delete_batch(), which calls it under
rcu_read_lock() only.
On CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or
migration, so the task can migrate between CPUs during the delete loop,
causing this_cpu_ptr() to trigger:
BUG: using smp_processor_id() in preemptible [00000000] code
Fix by wrapping the delete loop in migrate_disable()/migrate_enable()
in __rhtab_map_lookup_and_delete_batch(), matching the migration
protection that the other callers already provide.
Fixes: 818e00848227 ("bpf: Implement iteration ops for resizable hashtab")
Reported-by: [email protected]
Signed-off-by: Ömer Mete Kaya <[email protected]>
Signed-off-by: Alexei Starovoitov <[email protected]>
Acked-by: Mykyta Yatsenko <[email protected]>
Link: https://patch.msgid.link/[email protected]
Closes: https://syzkaller.appspot.com/bug?extid=fd7e415d891073b83e1f
- Commit
- de020dc8049bfb2b22e3b6d99c031feb2e22d112
- Parents
- 7b12c538
Changes
1 files changed · +2 −0
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 548eb1c..13a2356 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -3374,8 +3374,10 @@ static int __rhtab_map_lookup_and_delete_batch(struct bpf_map *map,
}
if (do_delete) {
+ migrate_disable();
for (i = 0; i < total; i++)
rhtab_delete_elem(rhtab, del_elems[i], NULL, 0);
+ migrate_enable();
}
rcu_read_unlock();