[PATCH bpf v2] bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()

[PATCH bpf v2] bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()

[Ömer Mete Kaya]

bpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration
to be disabled. All callers of rhtab_delete_elem() disable migration
except __rhtab_map_lookup_and_delete_batch(), which calls it under
rcu_read_lock() only.

On CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or
migration, so the task can migrate between CPUs during the delete loop,
causing this_cpu_ptr() to trigger:

  BUG: using smp_processor_id() in preemptible [00000000] code

Fix by wrapping the delete loop in migrate_disable()/migrate_enable()
in __rhtab_map_lookup_and_delete_batch(), matching the migration
protection that the other callers already provide.

Fixes: 818e00848227 ("bpf: Implement iteration ops for resizable hashtab")
Reported-by: syzbot+fd7e415d891073b83e1f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fd7e415d891073b83e1f
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
---
Changes in v2:
  - Fix root cause in __rhtab_map_lookup_and_delete_batch() with
    migrate_disable()/migrate_enable() instead of stretching
    bpf_disable_instrumentation() in rhtab_delete_elem().
  - Fix Fixes: tag to 818e00848227.
  - Fix commit message: migration disabled, not preemption.

Tested with syzkaller:
  - Before the fix: the reported warning was reproduced reliably.
  - After the fix: the warning was no longer reproducible.

 kernel/bpf/hashtab.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index f744a42bb813..2bb9ac7fc73e 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -3369,8 +3369,10 @@ static int __rhtab_map_lookup_and_delete_batch(struct bpf_map *map,
 	}

 	if (do_delete) {
+		migrate_disable();
 		for (i = 0; i < total; i++)
 			rhtab_delete_elem(rhtab, del_elems[i], NULL, 0);
+		migrate_enable();
 	}

 	rcu_read_unlock();
--
2.55.0

Re: [PATCH bpf v2] bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()

[Mykyta Yatsenko]

On 9/29/26 9:10 AM, Ömer Mete Kaya wrote:
> bpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration
> to be disabled. All callers of rhtab_delete_elem() disable migration
> except __rhtab_map_lookup_and_delete_batch(), which calls it under
> rcu_read_lock() only.
> 
> On CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or
> migration, so the task can migrate between CPUs during the delete loop,
> causing this_cpu_ptr() to trigger:
> 
>   BUG: using smp_processor_id() in preemptible [00000000] code
> 
> Fix by wrapping the delete loop in migrate_disable()/migrate_enable()
> in __rhtab_map_lookup_and_delete_batch(), matching the migration
> protection that the other callers already provide.
> 
> Fixes: 818e00848227 ("bpf: Implement iteration ops for resizable hashtab")
> Reported-by: syzbot+fd7e415d891073b83e1f@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=fd7e415d891073b83e1f
> Suggested-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
> ---

Acked-by: Mykyta Yatsenko <yatsenko@meta.com>

> Changes in v2:
>   - Fix root cause in __rhtab_map_lookup_and_delete_batch() with
>     migrate_disable()/migrate_enable() instead of stretching
>     bpf_disable_instrumentation() in rhtab_delete_elem().
>   - Fix Fixes: tag to 818e00848227.
>   - Fix commit message: migration disabled, not preemption.
> 
> Tested with syzkaller:
>   - Before the fix: the reported warning was reproduced reliably.
>   - After the fix: the warning was no longer reproducible.
> 
>  kernel/bpf/hashtab.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
> index f744a42bb813..2bb9ac7fc73e 100644
> --- a/kernel/bpf/hashtab.c
> +++ b/kernel/bpf/hashtab.c
> @@ -3369,8 +3369,10 @@ static int __rhtab_map_lookup_and_delete_batch(struct bpf_map *map,
>  	}
> 
>  	if (do_delete) {
> +		migrate_disable();
>  		for (i = 0; i < total; i++)
>  			rhtab_delete_elem(rhtab, del_elems[i], NULL, 0);
> +		migrate_enable();
>  	}
> 
>  	rcu_read_unlock();
> --
> 2.55.0
> 
>