mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-10-28 12:53:14 +01:00
Ömer Mete Kaya
de020dc804
bpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration
to be disabled. All callers of rhtab_delete_elem() disable migration
except __rhtab_map_lookup_and_delete_batch(), which calls it under
rcu_read_lock() only.
On CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or
migration, so the task can migrate between CPUs during the delete loop,
causing this_cpu_ptr() to trigger:
BUG: using smp_processor_id() in preemptible [00000000] code
Fix by wrapping the delete loop in migrate_disable()/migrate_enable()
in __rhtab_map_lookup_and_delete_batch(), matching the migration
protection that the other callers already provide.
Fixes: 818e008482 ("bpf: Implement iteration ops for resizable hashtab")
Reported-by: [email protected]
Signed-off-by: Ömer Mete Kaya <[email protected]>
Signed-off-by: Alexei Starovoitov <[email protected]>
Acked-by: Mykyta Yatsenko <[email protected]>
Link: https://patch.msgid.link/[email protected]
Closes: https://syzkaller.appspot.com/bug?extid=fd7e415d891073b83e1f