linux-kernel - Re: [syzbot] [perf?] WARNING: suspicious RCU usage in get_callchain

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260128085200.GE3372621@noisy.programming.kicks-ass.net>
Date: Wed, 28 Jan 2026 09:52:00 +0100
From: Peter Zijlstra <peterz@...radead.org>
To: Qing Wang <wangqing7171@...il.com>
Cc: syzbot+72a43cdb78469f7fbad1@...kaller.appspotmail.com, acme@...nel.org,
	adrian.hunter@...el.com, alexander.shishkin@...ux.intel.com,
	irogers@...gle.com, jolsa@...nel.org, linux-kernel@...r.kernel.org,
	linux-perf-users@...r.kernel.org, mark.rutland@....com,
	mingo@...hat.com, namhyung@...nel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [perf?] WARNING: suspicious RCU usage in
 get_callchain_entry

On Wed, Jan 28, 2026 at 11:55:08AM +0800, Qing Wang wrote:
> #syz test
> 
> diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
> index da3d328f5c15..f97d4aa9d038 100644
> --- a/kernel/bpf/stackmap.c
> +++ b/kernel/bpf/stackmap.c
> @@ -460,7 +460,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
>  
>  	max_depth = stack_map_calculate_max_depth(size, elem_size, flags);
>  
> -	if (may_fault)
> +	if (!trace_in)
>  		rcu_read_lock(); /* need RCU for perf's callchain below */
>  
>  	if (trace_in) {
> @@ -474,7 +474,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
>  	}
>  
>  	if (unlikely(!trace) || trace->nr < skip) {
> -		if (may_fault)
> +		if (!trace_in)
>  			rcu_read_unlock();
>  		goto err_fault;
>  	}
> @@ -494,7 +494,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
>  	}
>  
>  	/* trace/ips should not be dereferenced after this point */
> -	if (may_fault)
> +	if (!trace_in)
>  		rcu_read_unlock();
>  
>  	if (user_build_id)
> 

This is just papering over more bugs. There was a series out there
somewhere trying to fix up this code, let me see if I can find it in
this shitshow called an inbox :/