Re: [PATCH v2] bpf: Fix smp_processor_id() call trace for preemptible kernels

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 6/30/26 7:14 PM, Edward Adam Davis wrote:
> On Tue, 30 Jun 2026 09:48:23 +0000, Sashiko wrote:
>> [Severity: High]
>> Does this fix the issue at the right layer? By adding the preemption
>> protection here, it masks the fact that the caller is running with migration
>> enabled, which leaves sibling APIs vulnerable.
>>
>> For example, in __rhtab_map_lookup_and_delete_batch() in
>> kernel/bpf/hashtab.c, the batch loop iterates and calls rhtab_delete_elem()
>> without disabling migration.
>>
>> If the map elements contain special fields (like BPF_KPTR),
>> rhtab_delete_elem() will first call rhtab_check_and_free_fields(), which
>> eventually calls bpf_mem_free().
>>
>> Since bpf_mem_free() also uses this_cpu_ptr() without get_cpu() protection:
>>
>> kernel/bpf/memalloc.c:bpf_mem_free() {
>>      ...
>>      unit_free(this_cpu_ptr(ma->caches)->cache + idx, ptr);
>>      ...
>> }
>>
>> Will this result in the exact same BUG being triggered on that path? Should
>> the missing migration protection be added to
>> __rhtab_map_lookup_and_delete_batch() instead of modifying the allocator
>> here?
> Like this?
>
> diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
> index 9f394e1aa2e8..7b98c2eea685 100644
> --- a/kernel/bpf/hashtab.c
> +++ b/kernel/bpf/hashtab.c
> @@ -3345,8 +3345,10 @@ static int __rhtab_map_lookup_and_delete_batch(struct bpf_map *map,
>   	}
>   
>   	if (do_delete) {
> +		get_cpu();
>   		for (i = 0; i < total; i++)
>   			rhtab_delete_elem(rhtab, del_elems[i], NULL, 0);
> +		put_cpu();
>   	}
>   
>   	rcu_read_unlock();


This splat is specific to rhash...

For HASH/PERCPU_HASH/..., most operations are performed under
bpf_disable_instrumentation(); see __htab_map_lookup_and_delete_batch().

But for rhash, bpf_mem_cache_free_rcu() is called outside the
bpf_disable_instrumentation() region; see 
__rhtab_map_lookup_and_delete_batch().

note: map_lookup_and_delete_batch() disable cpu migration