netdev - Re: [PATCH v3] bpf: test_run: fix atomic context in timer path causing sleep-in-atomic BUG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <u63lefbfseajkacl5uixafvvtlcwnpypxwqnrbgc5ec5c3tciy@prxb2yriebfy>
Date: Tue, 14 Oct 2025 01:31:28 +0530
From: Brahmajit Das <listout@...tout.xyz>
To: Yonghong Song <yonghong.song@...ux.dev>
Cc: Sahil Chandna <chandna.linuxkernel@...il.com>, ast@...nel.org, 
	daniel@...earbox.net, andrii@...nel.org, martin.lau@...ux.dev, song@...nel.org, 
	john.fastabend@...il.com, haoluo@...gle.com, jolsa@...nel.org, bpf@...r.kernel.org, 
	netdev@...r.kernel.org, david.hunter.linux@...il.com, skhan@...uxfoundation.org, 
	khalid@...nel.org
Subject: Re: [PATCH v3] bpf: test_run: fix atomic context in timer path
 causing sleep-in-atomic BUG

On 13.10.2025 11:35, Yonghong Song wrote:
> 
> 
> On 10/13/25 10:11 AM, Sahil Chandna wrote:
> > The timer mode is initialized to NO_PREEMPT mode by default,
> > this disable preemption and force execution in atomic context
> > causing issue on PREEMPT_RT configurations when invoking
> > spin_lock_bh(), leading to the following warning:
> > 
> > BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
> > in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6107, name: syz.0.17
> > preempt_count: 1, expected: 0
> > RCU nest depth: 1, expected: 1
> > Preemption disabled at:
> > [<ffffffff891fce58>] bpf_test_timer_enter+0xf8/0x140 net/bpf/test_run.c:42
> > 
> > Fix this, by removing NO_PREEMPT/NO_MIGRATE mode check.
> > Also, the test timer context no longer needs explicit calls to
> > migrate_disable()/migrate_enable() with rcu_read_lock()/rcu_read_unlock().
> > Use helpers rcu_read_lock_dont_migrate() and rcu_read_unlock_migrate()
> > instead.
> > 
> > Reported-by: syzbot+1f1fbecb9413cdbfbef8@...kaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=1f1fbecb9413cdbfbef8
> > Tested-by: syzbot+1f1fbecb9413cdbfbef8@...kaller.appspotmail.com
> > Signed-off-by: Sahil Chandna <chandna.linuxkernel@...il.com>
> 
> You have multiple versions in CI:
>   [PATCH v2] bpf: avoid sleeping in invalid context during sock_map_delete_elem path
>   [PATCH v3] bpf: test_run: fix atomic context in timer path causing sleep-in-atomic BUG
Yeah, my bad. The v2 is mine, which I send few mins before Sahil

https://lore.kernel.org/all/20251013171122.1403859-1-listout@listout.xyz/T/
> 
> In the future, please submit new patch set only after some reviews on the old patch.
> 
> I also recommend to replace e.g. [PATCH v3] to [PATCH bpf v3] (or [PATCH bpf-next v3])
> so CI can do proper testing for either bpf or bpf-next.
> 
> For the title:
>   bpf: test_run: fix atomic context in timer path causing sleep-in-atomic BUG
> Change to:
>   bpf: Fix sleep-in-atomic BUG in timer path with RT kernel
> 
> The code change LGTM.
> 
> Acked-by: Yonghong Song <yonghong.song@...ux.dev>
> 
> > 
> > ---
> > Changes since v2:
> > - Fix uninitialized struct bpf_test_timer
> > 
> > Changes since v1:
> > - Dropped `enum { NO_PREEMPT, NO_MIGRATE } mode` from `struct bpf_test_timer`.
> > - Removed all conditional preempt/migrate disable logic.
> > - Unified timer handling to use `migrate_disable()` / `migrate_enable()` universally.
> > 
> > Link to v2: https://lore.kernel.org/all/20251010075923.408195-1-chandna.linuxkernel@gmail.com/
> > Link to v1: https://lore.kernel.org/all/20251006054320.159321-1-chandna.linuxkernel@gmail.com/
> > 
> > Testing:
> > - Reproduced syzbot bug locally using the provided reproducer.
> > - Observed `BUG: sleeping function called from invalid context` on v1.
> > - Confirmed bug disappears after applying this patch.
> > - Validated normal functionality of `bpf_prog_test_run_*` helpers with C
> >    reproducer.
> > ---
> >   net/bpf/test_run.c | 23 ++++++-----------------
> >   1 file changed, 6 insertions(+), 17 deletions(-)
> 
> [...]
> 

-- 
Regards,
listout