linux-kernel - Re: [PATCH] bpf: avoid sleeping in invalid context during sock_map_delete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAADnVQKbmTgwXf5WvXACKUNbzs8r+Cvgx6KyyD7Xq1SOL9gLmg@mail.gmail.com>
Date: Thu, 9 Oct 2025 15:38:17 -0700
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Brahmajit Das <listout@...tout.xyz>
Cc: syzbot+1f1fbecb9413cdbfbef8@...kaller.appspotmail.com, 
	Alexei Starovoitov <ast@...nel.org>, bpf <bpf@...r.kernel.org>, 
	LKML <linux-kernel@...r.kernel.org>, Network Development <netdev@...r.kernel.org>, 
	syzkaller-bugs <syzkaller-bugs@...glegroups.com>, Yonghong Song <yonghong.song@...ux.dev>
Subject: Re: [PATCH] bpf: avoid sleeping in invalid context during
 sock_map_delete_elem path

On Thu, Oct 9, 2025 at 3:29 PM Brahmajit Das <listout@...tout.xyz> wrote:
>
> #syz test
>
> The syzkaller report exposed a BUG: “sleeping function called from
> invalid context” in sock_map_delete_elem, which happens when
> `bpf_test_timer_enter()` disables preemption but the delete path later
> invokes a sleeping function while still in that context. Specifically:
>
> - The crash trace shows `bpf_test_timer_enter()` acquiring a
>   preempt_disable path (via t->mode == NO_PREEMPT), but the symmetric
>   release path always calls migrate_enable(), mismatching the earlier
>   disable.
> - As a result, preemption remains disabled across the
>   sock_map_delete_elem path, leading to a sleeping call under an invalid
>   context. :contentReference[oaicite:0]{index=0}
>
> To fix this, normalize the disable/enable pairing: always use
> migrate_disable()/migrate_enable() regardless of t->mode. This ensures
> that we never remain with preemption disabled unintentionally when
> entering the delete path, and avoids invalid-context sleeping.
>
> Reported-by: syzbot+1f1fbecb9413cdbfbef8@...kaller.appspotmail.com
> Signed-off-by: Brahmajit Das <listout@...tout.xyz>
> ---
>  net/bpf/test_run.c | 10 ++--------
>  1 file changed, 2 insertions(+), 8 deletions(-)
>
> diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
> index dfb03ee0bb62..07ffe7d92c1c 100644
> --- a/net/bpf/test_run.c
> +++ b/net/bpf/test_run.c
> @@ -38,10 +38,7 @@ static void bpf_test_timer_enter(struct bpf_test_timer *t)
>         __acquires(rcu)
>  {
>         rcu_read_lock();
> -       if (t->mode == NO_PREEMPT)
> -               preempt_disable();
> -       else
> -               migrate_disable();
> +       migrate_disable();

pls search previous thread on this subject.

pw-bot: cr