Re: [syzbot] Re: [syzbot] [bpf?] [net?] KASAN: slab-use-after-free Read in bq_xmit_all

syzbot
2024-07-21T15:47:45Z

#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git upstream

---
include/linux/filter.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/linux/filter.h b/include/linux/filter.h
index b6672ff61407..22691015d175 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -842,15 +842,15 @@ static inline void bpf_net_ctx_get_all_used_flush_lists(struct list_head **lh_ma
if (!IS_ENABLED(CONFIG_BPF_SYSCALL))
return;

- lh = &bpf_net_ctx->dev_map_flush_list;
+ lh = this_cpu_ptr(&bpf_net_ctx->dev_map_flush_list);
if (kern_flags & BPF_RI_F_DEV_MAP_INIT && !list_empty(lh))
*lh_dev = lh;

- lh = &bpf_net_ctx->cpu_map_flush_list;
+ lh = this_cpu_ptr(&bpf_net_ctx->cpu_map_flush_list);
if (kern_flags & BPF_RI_F_CPU_MAP_INIT && !list_empty(lh))
*lh_map = lh;

- lh = &bpf_net_ctx->xskmap_map_flush_list;
+ lh = this_cpu_ptr(&bpf_net_ctx->xskmap_map_flush_list);
if (IS_ENABLED(CONFIG_XDP_SOCKETS) &&
kern_flags & BPF_RI_F_XSK_MAP_INIT && !list_empty(lh))
*lh_xsk = lh;
--