netdev - Re: [PATCH v3] bpf: test_run: fix atomic context in timer path causing sleep-in-atomic BUG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b7fa9c76-f343-42d0-9c47-6a1af0deea2c@linux.dev>
Date: Mon, 13 Oct 2025 11:35:35 -0700
From: Yonghong Song <yonghong.song@...ux.dev>
To: Sahil Chandna <chandna.linuxkernel@...il.com>, ast@...nel.org,
 daniel@...earbox.net, andrii@...nel.org, martin.lau@...ux.dev,
 song@...nel.org, john.fastabend@...il.com, haoluo@...gle.com,
 jolsa@...nel.org, bpf@...r.kernel.org, netdev@...r.kernel.org
Cc: david.hunter.linux@...il.com, skhan@...uxfoundation.org, khalid@...nel.org
Subject: Re: [PATCH v3] bpf: test_run: fix atomic context in timer path
 causing sleep-in-atomic BUG



On 10/13/25 10:11 AM, Sahil Chandna wrote:
> The timer mode is initialized to NO_PREEMPT mode by default,
> this disable preemption and force execution in atomic context
> causing issue on PREEMPT_RT configurations when invoking
> spin_lock_bh(), leading to the following warning:
>
> BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
> in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6107, name: syz.0.17
> preempt_count: 1, expected: 0
> RCU nest depth: 1, expected: 1
> Preemption disabled at:
> [<ffffffff891fce58>] bpf_test_timer_enter+0xf8/0x140 net/bpf/test_run.c:42
>
> Fix this, by removing NO_PREEMPT/NO_MIGRATE mode check.
> Also, the test timer context no longer needs explicit calls to
> migrate_disable()/migrate_enable() with rcu_read_lock()/rcu_read_unlock().
> Use helpers rcu_read_lock_dont_migrate() and rcu_read_unlock_migrate()
> instead.
>
> Reported-by: syzbot+1f1fbecb9413cdbfbef8@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=1f1fbecb9413cdbfbef8
> Tested-by: syzbot+1f1fbecb9413cdbfbef8@...kaller.appspotmail.com
> Signed-off-by: Sahil Chandna <chandna.linuxkernel@...il.com>

You have multiple versions in CI:
   [PATCH v2] bpf: avoid sleeping in invalid context during sock_map_delete_elem path
   [PATCH v3] bpf: test_run: fix atomic context in timer path causing sleep-in-atomic BUG

In the future, please submit new patch set only after some reviews on the old patch.

I also recommend to replace e.g. [PATCH v3] to [PATCH bpf v3] (or [PATCH bpf-next v3])
so CI can do proper testing for either bpf or bpf-next.

For the title:
   bpf: test_run: fix atomic context in timer path causing sleep-in-atomic BUG
Change to:
   bpf: Fix sleep-in-atomic BUG in timer path with RT kernel

The code change LGTM.

Acked-by: Yonghong Song <yonghong.song@...ux.dev>

>
> ---
> Changes since v2:
> - Fix uninitialized struct bpf_test_timer
>
> Changes since v1:
> - Dropped `enum { NO_PREEMPT, NO_MIGRATE } mode` from `struct bpf_test_timer`.
> - Removed all conditional preempt/migrate disable logic.
> - Unified timer handling to use `migrate_disable()` / `migrate_enable()` universally.
>
> Link to v2: https://lore.kernel.org/all/20251010075923.408195-1-chandna.linuxkernel@gmail.com/
> Link to v1: https://lore.kernel.org/all/20251006054320.159321-1-chandna.linuxkernel@gmail.com/
>
> Testing:
> - Reproduced syzbot bug locally using the provided reproducer.
> - Observed `BUG: sleeping function called from invalid context` on v1.
> - Confirmed bug disappears after applying this patch.
> - Validated normal functionality of `bpf_prog_test_run_*` helpers with C
>    reproducer.
> ---
>   net/bpf/test_run.c | 23 ++++++-----------------
>   1 file changed, 6 insertions(+), 17 deletions(-)

[...]