From: Yonghong Song <yonghong.song@linux.dev>
To: bot+bpf-ci@kernel.org, chandna.sahil@gmail.com, ast@kernel.org,
daniel@iogearbox.net, andrii@kernel.org, martin.lau@linux.dev,
eddyz87@gmail.com, song@kernel.org, john.fastabend@gmail.com,
kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com,
jolsa@kernel.org, bigeasy@linutronix.de, bpf@vger.kernel.org
Cc: syzbot+b0cff308140f79a9c4cb@syzkaller.appspotmail.comi,
martin.lau@kernel.org, clm@meta.com, ihor.solodrai@linux.dev
Subject: Re: [PATCH bpf-next] bpf: use preempt_disable/enable() to protect bpf_bprintf_buffers nesting
Date: Sun, 9 Nov 2025 11:44:48 -0800 [thread overview]
Message-ID: <2ed9877e-77e4-4f18-84fd-dc8b1ffe810f@linux.dev> (raw)
In-Reply-To: <588e208637619b6c256f2a70dc35faeafda1a843b6410def9fa53ef8876a46e8@mail.kernel.org>
On 11/9/25 10:07 AM, bot+bpf-ci@kernel.org wrote:
>> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
>> index 865b0dae3..99780b654 100644
>> --- a/kernel/bpf/helpers.c
>> +++ b/kernel/bpf/helpers.c
>> @@ -774,9 +774,11 @@ int bpf_try_get_buffers(struct bpf_bprintf_buffers **bufs)
>> {
>> int nest_level;
>>
>> + preempt_disable();
>> nest_level = this_cpu_inc_return(bpf_bprintf_nest_level);
>> if (WARN_ON_ONCE(nest_level > MAX_BPRINTF_NEST_LEVEL)) {
>> this_cpu_dec(bpf_bprintf_nest_level);
>> + preempt_enable();
>> return -EBUSY;
>> }
>> *bufs = this_cpu_ptr(&bpf_bprintf_bufs[nest_level - 1]);
>> @@ -786,9 +788,12 @@ int bpf_try_get_buffers(struct bpf_bprintf_buffers **bufs)
>>
>> void bpf_put_buffers(void)
>> {
>> - if (WARN_ON_ONCE(this_cpu_read(bpf_bprintf_nest_level) == 0))
>> + if (WARN_ON_ONCE(this_cpu_read(bpf_bprintf_nest_level) == 0)) {
>> + preempt_enable();
> ^^^^^^^^^^^^^^
>
> Can this cause a preempt count underflow? The WARN_ON_ONCE checks for
> nest_level==0, which means bpf_try_get_buffers() was never successfully
> called. In that case, preempt_disable() was never called either, so calling
> preempt_enable() here would underflow the preempt count.
>
> In the normal calling pattern, bpf_try_get_buffers() either succeeds
> (disabling preemption) or fails before reaching bpf_put_buffers(). But this
> WARN exists to catch programming bugs where the get/put contract is violated.
> If such a bug occurs, adding preempt_enable() here makes it worse by
> introducing a preempt count imbalance on top of the original error.
Sorry, Sahil. I made a wrong suggestion earlier and the above AI analysis is correct.
We should not have preempt_enable() in the above. Please make the
change and submit v2.
>
>> + return;
>> + }
>> this_cpu_dec(bpf_bprintf_nest_level);
>> + preempt_enable();
>> }
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/19212189476
next prev parent reply other threads:[~2025-11-09 19:45 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-09 17:36 [PATCH bpf-next] bpf: use preempt_disable/enable() to protect bpf_bprintf_buffers nesting Sahil Chandna
2025-11-09 18:07 ` bot+bpf-ci
2025-11-09 19:44 ` Yonghong Song [this message]
2025-11-10 13:25 ` Sebastian Andrzej Siewior
2025-11-10 17:44 ` Yonghong Song
2025-11-11 10:37 ` Sebastian Andrzej Siewior
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2ed9877e-77e4-4f18-84fd-dc8b1ffe810f@linux.dev \
--to=yonghong.song@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bigeasy@linutronix.de \
--cc=bot+bpf-ci@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=chandna.sahil@gmail.com \
--cc=clm@meta.com \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=ihor.solodrai@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=martin.lau@kernel.org \
--cc=martin.lau@linux.dev \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=syzbot+b0cff308140f79a9c4cb@syzkaller.appspotmail.comi \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox