Noorain Eqbal de2ce6b14b bpf: Sync pending IRQ work before freeing ring buffer ... [ Upstream commit 4e90776383 ] Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work complete before freeing the buffer. Fixes: 457f44363a ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2617fc732430968b45d2 Tested-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com Signed-off-by: Noorain Eqbal <nooraineqbal@gmail.com> Link: https://lore.kernel.org/r/20251020180301.103366-1-nooraineqbal@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-12-07 06:09:13 +09:00
..
bpf	bpf: Sync pending IRQ work before freeing ring buffer	2025-12-07 06:09:13 +09:00
cgroup	cgroup: split cgroup_destroy_wq into 3 workqueues	2025-10-02 13:39:05 +02:00
configs
debug	kdb: Do not assume write() callback available	2025-03-13 12:50:45 +01:00
dma	dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted	2025-09-04 14:28:47 +02:00
entry	entry: Respect changes to system call number by trace_sys_enter()	2024-04-10 16:18:46 +02:00
events	perf/core: Prevent VMA split of buffer mappings	2025-08-28 16:24:14 +02:00
futex	futex: Don't include process MM in futex key on no-MMU	2023-11-20 11:08:13 +01:00
gcov	gcov: add support for GCC 14	2024-07-05 09:14:34 +02:00
irq	genirq: Provide new interfaces for affinity hints	2025-10-02 13:39:03 +02:00
kcsan	kcsan: Turn report_filterlist_lock into a raw_spinlock	2024-12-14 19:51:35 +01:00
livepatch	livepatch: Fix missing newline character in klp_resolve_symbols()	2023-11-20 11:08:25 +01:00
locking	locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()	2025-05-02 07:44:03 +02:00
power	PM: sleep: console: Fix the black screen issue	2025-08-28 16:24:18 +02:00
printk	printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX	2025-03-13 12:50:17 +01:00
rcu	rcu: Protect ->defer_qs_iw_pending from data race	2025-08-28 16:24:20 +02:00
sched	sched/fair: Fix pelt lost idle time detection	2025-10-29 14:03:09 +01:00
time	hrtimers: Unconditionally update target CPU base after offline timer migration	2025-10-02 13:39:04 +02:00
trace	minmax: make generic MIN() and MAX() macros available everywhere	2025-10-19 16:21:52 +02:00
.gitignore
acct.c	acct: block access to kernel internal filesystems	2025-03-13 12:50:54 +01:00
async.c	async: Introduce async_schedule_dev_nocall()	2024-02-23 08:54:25 +01:00
audit_fsnotify.c	fsnotify: make allow_dups a property of the group	2024-04-10 16:19:02 +02:00
audit_tree.c	fsnotify: pass flags argument to fsnotify_alloc_group()	2024-04-10 16:19:02 +02:00
audit_watch.c	fsnotify: pass flags argument to fsnotify_alloc_group()	2024-04-10 16:19:02 +02:00
audit.c	audit: Send netlink ACK before setting connection in auditd_set	2024-02-23 08:54:37 +01:00
audit.h	audit: log AUDIT_TIME_* records only from rules	2022-04-08 14:23:06 +02:00
auditfilter.c	ima: Avoid blocking in RCU read-side critical section	2024-07-18 13:07:34 +02:00
auditsc.c	audit: fix possible soft lockup in __audit_inode_child()	2023-09-19 12:22:39 +02:00
backtracetest.c
bounds.c	bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS	2024-05-02 16:24:50 +02:00
capability.c
cfi.c	cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle	2022-06-22 14:22:04 +02:00
compat.c	sched_getaffinity: don't assume 'cpumask_size()' is fully initialized	2023-04-05 11:24:53 +02:00
configs.c
context_tracking.c
cpu_pm.c
cpu.c	hrtimers: Handle CPU state correctly on hotplug	2025-01-23 17:16:02 +01:00
crash_core.c	kernel/crash_core: suppress unknown crashkernel parameter warning	2021-12-29 12:28:49 +01:00
crash_dump.c
cred.c	cred: switch to using atomic_long_t	2023-12-20 15:17:37 +01:00
delayacct.c
dma.c
exec_domain.c
exit.c	perf: Fix sample vs do_exit()	2025-06-27 11:05:38 +01:00
extable.c
fail_function.c	kernel/fail_function: fix memory leak with using debugfs_lookup()	2023-03-11 13:57:38 +01:00
fork.c	copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)	2025-10-19 16:21:44 +02:00
freezer.c
gen_kheaders.sh	kheaders: Ignore silly-rename files	2025-01-23 17:16:00 +01:00
groups.c
hung_task.c	hung_task: move hung_task sysctl interface to hung_task.c	2025-03-13 12:49:50 +01:00
iomem.c
irq_work.c
jump_label.c
kallsyms.c	kallsyms: Make kallsyms_on_each_symbol generally available	2023-12-13 18:36:45 +01:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks	locking/rwlock: Provide RT variant	2021-08-17 17:50:51 +02:00
Kconfig.preempt
kcov.c	kcov: mark in_softirq_really() as __always_inline	2025-01-09 13:28:50 +01:00
kexec_core.c	kexec: fix a memory leak in crash_shrink_memory()	2023-07-23 13:46:52 +02:00
kexec_elf.c	kexec: initialize ELF lowest address to ULONG_MAX	2025-04-10 14:32:01 +02:00
kexec_file.c	kexec: support purgatories with .text.hot sections	2023-06-21 15:59:14 +02:00
kexec_internal.h	panic, kexec: make __crash_kexec() NMI safe	2023-04-20 12:13:57 +02:00
kexec.c	kernel: kexec: copy user-array safely	2023-11-28 16:56:16 +00:00
kheaders.c	kheaders: Use array declaration instead of char	2023-05-11 23:00:17 +09:00
kmod.c
kprobes.c	kprobes: Fix to check symbol prefixes correctly	2024-08-19 05:45:42 +02:00
ksysfs.c	kexec: turn all kexec_mutex acquisitions into trylocks	2023-04-20 12:13:57 +02:00
kthread.c	kthread: unpark only parked kthread	2024-10-17 15:12:00 +02:00
latencytop.c
Makefile	futex: Move to kernel/futex/	2022-12-31 13:14:04 +01:00
module_signature.c
module_signing.c
module-internal.h
module.c	NFSD: Remove svc_serv_ops::svo_module	2024-04-10 16:19:01 +02:00
notifier.c
nsproxy.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
padata.c	padata: Reset next CPU when reorder sequence wraps around	2025-10-29 14:03:14 +01:00
panic.c	panic: Flush kernel log buffer at the end	2024-04-13 13:01:43 +02:00
params.c	module: ensure that kobject_put() is safe for module type kobjects	2025-05-18 08:20:37 +02:00
pid_namespace.c	zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING	2024-07-05 09:14:24 +02:00
pid.c	pid: Add a judgment for ns null in pid_nr_ns	2025-10-19 16:21:54 +02:00
profile.c	profiling: remove profile=sleep support	2024-08-19 05:45:39 +02:00
ptrace.c	ptrace: Reimplement PTRACE_KILL by always sending SIGKILL	2022-06-09 10:22:29 +02:00
range.c
reboot.c	kernel/reboot: emergency_restart: Set correct system_state	2023-11-28 16:56:31 +00:00
regset.c
relay.c	relayfs: fix out-of-bounds access in relay_file_read	2023-05-11 23:00:18 +09:00
resource_kunit.c
resource.c	resource: fix region_intersects() vs add_memory_driver_managed()	2024-10-17 15:11:59 +02:00
rseq.c	rseq: Fix segfault on registration when rseq_cs is non-zero	2025-07-17 18:30:55 +02:00
scftorture.c	scftorture: Forgive memory-allocation failure if KASAN	2023-09-23 11:09:55 +02:00
scs.c	scs: Release kasan vmalloc poison in scs_free process	2021-11-18 19:16:29 +01:00
seccomp.c	seccomp: Invalidate seccomp mode to catch death failures	2022-02-16 12:56:38 +01:00
signal.c	signal: Replace BUG_ON()s	2024-10-17 15:11:27 +02:00
smp.c	smp: Fix up and expand the smp_call_function_many() kerneldoc	2025-10-19 16:21:31 +02:00
smpboot.c
smpboot.h
softirq.c	lockdep: Fix wait context check on softirq for PREEMPT_RT	2025-06-04 14:37:55 +02:00
stackleak.c	gcc-plugins/stackleak: Use noinstr in favor of notrace	2022-02-23 12:03:07 +01:00
stacktrace.c	stacktrace: move filter_irq_stacks() to kernel/stacktrace.c	2022-04-13 20:59:28 +02:00
static_call_inline.c	x86/static-call: provide a way to do very early static-call updates	2024-12-19 18:07:22 +01:00
static_call.c	static_call: Don't make __static_call_return0 static	2022-04-13 20:59:28 +02:00
stop_machine.c
sys_ni.c	syscalls: fix compat_sys_io_pgetevents_time64 usage	2024-07-05 09:14:50 +02:00
sys.c	getrusage: use sig->stats_lock rather than lock_task_sighand()	2024-03-15 10:48:22 -04:00
sysctl-test.c
sysctl.c	fs: move fs stat sysctls to file_table.c	2025-03-13 12:49:50 +01:00
task_work.c	task_work: Introduce task_work_cancel() again	2024-08-19 05:45:13 +02:00
taskstats.c
test_kprobes.c
torture.c	torture: Fix hang during kthread shutdown phase	2023-08-30 16:18:19 +02:00
tracepoint.c
tsacct.c	taskstats: Cleanup the use of task->exit_code	2022-01-27 11:05:35 +01:00
ucount.c	ucount: fix atomic_long_inc_below() argument type	2025-08-28 16:24:11 +02:00
uid16.c
uid16.h
umh.c
up.c
user_namespace.c	ucounts: Fix systemd LimitNPROC with private users regression	2022-03-08 19:12:42 +01:00
user-return-notifier.c
user.c	fs/epoll: use a per-cpu counter for user's watches count	2021-09-08 11:50:27 -07:00
usermode_driver.c
utsname_sysctl.c
utsname.c
watch_queue.c	watch_queue: fix pipe accounting mismatch	2025-04-10 14:31:57 +02:00
watchdog_hld.c	watchdog/perf: properly initialize the turbo mode timestamp and rearm counter	2024-08-19 05:45:20 +02:00
watchdog.c	watchdog: move softlockup_panic back to early_param	2023-11-28 16:56:28 +00:00
workqueue_internal.h	workqueue: Assign a color to barrier work items	2021-08-17 07:49:10 -10:00
workqueue.c	workqueue: Improve scalability of workqueue watchdog touch	2024-09-12 11:07:52 +02:00