Noorain Eqbal de2ce6b14b bpf: Sync pending IRQ work before freeing ring buffer ...

[ Upstream commit 4e90776383 ]

Fix a race where irq_work can be queued in bpf_ringbuf_commit()
but the ring buffer is freed before the work executes.
In the syzbot reproducer, a BPF program attached to sched_switch
triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer
is freed before this work executes, the irq_work thread may accesses
freed memory.
Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work
complete before freeing the buffer.

Fixes: 457f44363a ("bpf: Implement BPF ring buffer and verifier support for it")
Reported-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2617fc732430968b45d2
Tested-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com
Signed-off-by: Noorain Eqbal <nooraineqbal@gmail.com>
Link: https://lore.kernel.org/r/20251020180301.103366-1-nooraineqbal@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-12-07 06:09:13 +09:00

..

preload

…

arraymap.c

bpf: Move bpf map owner out of common struct

2025-09-09 18:50:17 +02:00

bpf_inode_storage.c

…

bpf_iter.c

…

bpf_local_storage.c

bpf: Annotate data races in bpf_local_storage

2023-05-24 17:36:44 +01:00

bpf_lru_list.c

bpf: Address KCSAN report on bpf_lru_list

2024-03-01 13:21:55 +01:00

bpf_lru_list.h

bpf: Address KCSAN report on bpf_lru_list

2024-03-01 13:21:55 +01:00

bpf_lsm.c

…

bpf_struct_ops_types.h

…

bpf_struct_ops.c

…

bpf_task_storage.c

bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy

2022-10-26 12:34:41 +02:00

btf.c

bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o

2024-08-19 05:44:59 +02:00

cgroup.c

bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen

2023-07-23 13:46:49 +02:00

core.c

bpf: Fix oob access in cgroup local storage

2025-09-09 18:50:17 +02:00

cpumap.c

xdp: Move conversion to xdp_frame out of map functions

2024-05-17 11:50:47 +02:00

devmap.c

bpf: fix OOB devmap writes when deleting elements

2024-12-14 19:51:33 +01:00

disasm.c

…

disasm.h

…

dispatcher.c

…

hashtab.c

bpf: fix possible endless loop in BPF map iteration

2025-06-04 14:37:54 +02:00

helpers.c

bpf: Reject %p% format string in bprintf-like helpers

2025-08-28 16:24:01 +02:00

inode.c

bpf: Avoid RCU context warning when unpinning htab with internal structs

2025-10-19 16:21:43 +02:00

Kconfig

…

local_storage.c

…

lpm_trie.c

bpf: Fix exact match conditions in trie_get_next_key()

2024-12-14 19:51:31 +01:00

Makefile

…

map_in_map.c

bpf: Defer the free of inner map when necessary

2024-03-26 18:21:12 -04:00

map_in_map.h

bpf: Add map and need_defer parameters to .map_fd_put_ptr()

2024-02-23 08:54:42 +01:00

map_iter.c

bpf: Introduce MEM_RDONLY flag

2022-05-01 17:22:24 +02:00

net_namespace.c

…

offload.c

bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD

2023-01-24 07:22:46 +01:00

percpu_freelist.c

bpf: Initialize same number of free nodes for each pcpu_freelist

2022-11-26 09:24:38 +01:00

percpu_freelist.h

…

prog_iter.c

…

queue_stack_maps.c

bpf: Avoid deadlock when using queue and stack maps from NMI

2023-10-06 13:18:04 +02:00

reuseport_array.c

…

ringbuf.c

bpf: Sync pending IRQ work before freeing ring buffer

2025-12-07 06:09:13 +09:00

stackmap.c

bpf: Fix stackmap overflow check on 32-bit arches

2024-03-26 18:21:22 -04:00

syscall.c

bpf: Move bpf map owner out of common struct

2025-09-09 18:50:17 +02:00

sysfs_btf.c

…

task_iter.c

…

tnum.c

…

trampoline.c

x86/ibt,ftrace: Search for __fentry__ location

2024-07-05 09:14:12 +02:00

verifier.c

bpf: Reject bpf_timer for PREEMPT_RT

2025-10-02 13:39:11 +02:00