From: patchwork-bot+netdevbpf@kernel.org
To: Mani Tofigh <mt4022@columbia.edu>
Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
eddyz87@gmail.com, memxor@gmail.com, martin.lau@linux.dev,
song@kernel.org, yonghong.song@linux.dev, jolsa@kernel.org,
emil@etsalapatis.com, ihor.solodrai@linux.dev, yatsenko@meta.com,
bpf@vger.kernel.org, linux-kernel@vger.kernel.org,
tz2294@columbia.edu
Subject: Re: [PATCH bpf] bpf: Fix bpf_timer callback running on a freed map
Date: Tue, 27 Oct 2026 19:40:04 +0000 [thread overview]
Message-ID: <179313000458.289932.11629601440991927072.git-patchwork-notify@kernel.org> (raw)
In-Reply-To: <20261027-bpf-timer-freed-map-v1-1-30402b0ee99b@columbia.edu>
Hello:
This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:
On Tue, 27 Oct 2026 13:03:42 -0400 you wrote:
> From: Mani Tofigh <mt4022@columbia.edu>
>
> A bpf_timer in an inner map can fire after the map has been freed, and
> bpf_timer_cb() then reads the freed map:
>
> [ 50.709520] BUG: KASAN: slab-use-after-free in bpf_timer_cb+0x249/0x290
> [ 50.709540] Read of size 4 at addr ff11000003bc1030 by task bpftimer/72
> ...
> [ 50.710783] Freed by task 12:
> ...
> [ 50.710826] bpf_map_free+0x1a2/0x380
>
> [...]
Here is the summary with links:
- [bpf] bpf: Fix bpf_timer callback running on a freed map
https://git.kernel.org/bpf/bpf/c/815a0a2a40d6
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
prev parent reply other threads:[~2026-10-27 19:40 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 17:03 [PATCH bpf] bpf: Fix bpf_timer callback running on a freed map Mani Tofigh
2026-10-27 17:03 ` Mani Tofigh via B4 Relay
2026-10-27 18:48 ` Mahe Tardy
2026-10-27 19:40 ` patchwork-bot+netdevbpf [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=179313000458.289932.11629601440991927072.git-patchwork-notify@kernel.org \
--to=patchwork-bot+netdevbpf@kernel.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=mt4022@columbia.edu \
--cc=song@kernel.org \
--cc=tz2294@columbia.edu \
--cc=yatsenko@meta.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.