From: Jiayuan Chen <jiayuan.chen@linux.dev>
To: 梅开彦 <kaiyanm@hust.edu.cn>, bpf邮件列表 <bpf@vger.kernel.org>
Cc: "dzm91@hust.edu.cn" <dzm91@hust.edu.cn>, dddddd@hust.edu.cn
Subject: Re: BUG: using smp_processor_id() in preemptible code in bpf_mem_cache_free_rcu
Date: Wed, 30 Sep 2026 15:02:45 +0800 [thread overview]
Message-ID: <72be1025-342c-4832-8371-64a9b73d605e@linux.dev> (raw)
In-Reply-To: <7630c316.5cc7.1a0f0ca5f88.Coremail.kaiyanm@hust.edu.cn>
On 9/30/26 1:29 PM, 梅开彦 wrote:
> Our fuzzer tool discovered a preemption-safety vulnerability in the BPF
> subsystem (bpf-next 61c1e63c9b651a77b1e24208b9361965c69959e6).
> On a `BPF_MAP_LOOKUP_AND_DELETE_BATCH` over a
> `BPF_MAP_TYPE_RHASH` map, `rhtab_delete_elem()` calls
> `bpf_mem_cache_free_rcu()` in a preemptible (migratable) context,
> violating the "migration is disabled" contract of the BPF memory
> allocator, and `this_cpu_ptr()` triggers the
> `CONFIG_DEBUG_PREEMPT` check.
>
> Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
> Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
> Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
It duplicates the syzbot report [1]. You can follow the patch list inside.
[1]: https://syzkaller.appspot.com/bug?extid=fd7e415d891073b83e1f
prev parent reply other threads:[~2026-09-30 7:03 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-30 5:29 BUG: using smp_processor_id() in preemptible code in bpf_mem_cache_free_rcu 梅开彦
2026-09-30 7:02 ` Jiayuan Chen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=72be1025-342c-4832-8371-64a9b73d605e@linux.dev \
--to=jiayuan.chen@linux.dev \
--cc=bpf@vger.kernel.org \
--cc=dddddd@hust.edu.cn \
--cc=dzm91@hust.edu.cn \
--cc=kaiyanm@hust.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.