[v1] bpf: avoid sleeping in invalid context during sock_map_delete_elem path

[PATCH] bpf: avoid sleeping in invalid context during sock_map_delete_elem path

Posted by Brahmajit Das 2 months, 1 week ago

#syz test

The syzkaller report exposed a BUG: “sleeping function called from
invalid context” in sock_map_delete_elem, which happens when
`bpf_test_timer_enter()` disables preemption but the delete path later
invokes a sleeping function while still in that context. Specifically:

- The crash trace shows `bpf_test_timer_enter()` acquiring a
  preempt_disable path (via t->mode == NO_PREEMPT), but the symmetric
  release path always calls migrate_enable(), mismatching the earlier
  disable.
- As a result, preemption remains disabled across the
  sock_map_delete_elem path, leading to a sleeping call under an invalid
  context. :contentReference[oaicite:0]{index=0}

To fix this, normalize the disable/enable pairing: always use
migrate_disable()/migrate_enable() regardless of t->mode. This ensures
that we never remain with preemption disabled unintentionally when
entering the delete path, and avoids invalid-context sleeping.

Reported-by: syzbot+1f1fbecb9413cdbfbef8@syzkaller.appspotmail.com
Signed-off-by: Brahmajit Das <listout@listout.xyz>
---
 net/bpf/test_run.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index dfb03ee0bb62..07ffe7d92c1c 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -38,10 +38,7 @@ static void bpf_test_timer_enter(struct bpf_test_timer *t)
 	__acquires(rcu)
 {
 	rcu_read_lock();
-	if (t->mode == NO_PREEMPT)
-		preempt_disable();
-	else
-		migrate_disable();
+	migrate_disable();
 
 	t->time_start = ktime_get_ns();
 }
@@ -51,10 +48,7 @@ static void bpf_test_timer_leave(struct bpf_test_timer *t)
 {
 	t->time_start = 0;
 
-	if (t->mode == NO_PREEMPT)
-		preempt_enable();
-	else
-		migrate_enable();
+	migrate_enable();
 	rcu_read_unlock();
 }
 
-- 
2.51.0

Re: [syzbot] [bpf?] [net?] BUG: sleeping function called from invalid context in sock_map_delete_elem

Posted by syzbot 2 months, 1 week ago

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+1f1fbecb9413cdbfbef8@syzkaller.appspotmail.com
Tested-by: syzbot+1f1fbecb9413cdbfbef8@syzkaller.appspotmail.com

Tested on:

commit:         5472d60c Merge tag 'trace-v6.18-2' of git://git.kernel..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=159b91e2580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2b842a78bbee09b1
dashboard link: https://syzkaller.appspot.com/bug?extid=1f1fbecb9413cdbfbef8
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=11f50dcd980000

Note: testing is done by a robot and is best-effort only.

Re: [PATCH] bpf: avoid sleeping in invalid context during sock_map_delete_elem path

Posted by Alexei Starovoitov 2 months, 1 week ago

On Thu, Oct 9, 2025 at 3:29 PM Brahmajit Das <listout@listout.xyz> wrote:
>
> #syz test
>
> The syzkaller report exposed a BUG: “sleeping function called from
> invalid context” in sock_map_delete_elem, which happens when
> `bpf_test_timer_enter()` disables preemption but the delete path later
> invokes a sleeping function while still in that context. Specifically:
>
> - The crash trace shows `bpf_test_timer_enter()` acquiring a
>   preempt_disable path (via t->mode == NO_PREEMPT), but the symmetric
>   release path always calls migrate_enable(), mismatching the earlier
>   disable.
> - As a result, preemption remains disabled across the
>   sock_map_delete_elem path, leading to a sleeping call under an invalid
>   context. :contentReference[oaicite:0]{index=0}
>
> To fix this, normalize the disable/enable pairing: always use
> migrate_disable()/migrate_enable() regardless of t->mode. This ensures
> that we never remain with preemption disabled unintentionally when
> entering the delete path, and avoids invalid-context sleeping.
>
> Reported-by: syzbot+1f1fbecb9413cdbfbef8@syzkaller.appspotmail.com
> Signed-off-by: Brahmajit Das <listout@listout.xyz>
> ---
>  net/bpf/test_run.c | 10 ++--------
>  1 file changed, 2 insertions(+), 8 deletions(-)
>
> diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
> index dfb03ee0bb62..07ffe7d92c1c 100644
> --- a/net/bpf/test_run.c
> +++ b/net/bpf/test_run.c
> @@ -38,10 +38,7 @@ static void bpf_test_timer_enter(struct bpf_test_timer *t)
>         __acquires(rcu)
>  {
>         rcu_read_lock();
> -       if (t->mode == NO_PREEMPT)
> -               preempt_disable();
> -       else
> -               migrate_disable();
> +       migrate_disable();

pls search previous thread on this subject.

pw-bot: cr