Sanghyun Park fa9dcacdcd bpf: Fix mmap_lock leak in irq_work path ... stack_map_get_build_id_offset() introduced a per-CPU irq_work to defer mmap_read_unlock() from NMI context, and bpf_find_vma() later reused the same mmap_unlock_work. Both callers only check whether the work is busy before taking mmap_lock, so a nested caller can reuse the slot before the first caller queues it. Two read locks may then be acquired while only one deferred unlock runs, leaking a read lock and blocking exit_mmap(). Reserve the per-CPU slot before mmap_read_trylock(). Use the same wrapper in stackmap and bpf_find_vma() so both callers release the reservation on trylock failure. Keep rejecting the slot while the irq_work remains busy. Release it after the irq_work callback unlocks the mm. Fixes: eac9153f2b ("bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack()") Reported-by: syzbot+cdd6c0925e12b0af60cc@syzkaller.appspotmail.com Reported-by: sashiko-bot@kernel.org Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Closes: https://syzkaller.appspot.com/bug?extid=cdd6c0925e12b0af60cc Closes: https://lore.kernel.org/r/20260630033745.B80201F000E9@smtp.kernel.org Link: https://lore.kernel.org/bpf/20260805031425.2157475-2-sanghyun.park.cnu@gmail.com		2026-08-08 10:25:36 +02:00
..
preload	umd: Remove usermode driver framework	2025-07-26 21:03:04 +02:00
arena.c	bpf: Mark existing lock-safe kfuncs with KF_SPINLOCK_SAFE	2026-08-06 10:58:04 +02:00
arraymap.c	bpf: Cancel special fields on map value recycle	2026-06-09 21:23:11 -07:00
backtrack.c	bpf: Rename ARG_CONST_SIZE{,_OR_ZERO} to ARG_MEM_SIZE{,_OR_ZERO}	2026-08-03 00:29:14 +02:00
bloom_filter.c	bpf: Harden bloom filter sizing and indexing on 32-bit kernels	2026-08-05 11:45:20 -07:00
bpf_cgrp_storage.c	bpf: Remove gfp_flags plumbing from bpf_local_storage_update()	2026-04-10 21:22:32 -07:00
bpf_inode_storage.c	bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized	2026-06-30 16:31:56 +02:00
bpf_insn_array.c	bpf: Lose const-ness of map in map_check_btf()	2026-02-27 15:39:00 -08:00
bpf_iter.c	bpf: Inline bpf_iter_num_destroy() as a no-op	2026-08-05 10:44:35 -07:00
bpf_local_storage.c	bpf: Remove gfp_flags plumbing from bpf_local_storage_update()	2026-04-10 21:22:32 -07:00
bpf_lru_list.c	bpf: Fix NMI/tracepoint re-entry deadlock on lru locks	2026-06-07 18:46:13 -07:00
bpf_lru_list.h	bpf: Fix NMI/tracepoint re-entry deadlock on lru locks	2026-06-07 18:46:13 -07:00
bpf_lsm_proto.c	bpf: annotate file argument as __nullable in bpf_lsm_mmap_file	2025-12-21 10:56:33 -08:00
bpf_lsm.c	bpf: Rename ARG_CONST_SIZE{,_OR_ZERO} to ARG_MEM_SIZE{,_OR_ZERO}	2026-08-03 00:29:14 +02:00
bpf_struct_ops.c	bpf: Reject >8 byte return values on return-reading trampoline paths	2026-08-01 03:00:09 +02:00
bpf_task_storage.c	bpf: Remove gfp_flags plumbing from bpf_local_storage_update()	2026-04-10 21:22:32 -07:00
btf_iter.c	bpf: Remove custom build rule	2024-08-30 08:55:26 -07:00
btf_relocate.c	bpf: Remove custom build rule	2024-08-30 08:55:26 -07:00
btf.c	bpf: Remove unused BTF_FMODEL_STRUCT_ARG	2026-08-03 14:55:22 +02:00
cfg.c	bpf: Unify helper and kfunc call argument meta	2026-07-15 11:00:48 +02:00
cgroup_iter.c	bpf: add new BPF_CGROUP_ITER_CHILDREN control option	2026-01-27 09:05:54 -08:00
cgroup.c	bpf, cgroup: Fix storage null-ptr-deref after replacing prog	2026-08-07 15:39:24 -07:00
check_btf.c	bpf: Move BTF checking logic into check_btf.c	2026-04-12 12:37:04 -07:00
cnum_defs.h	bpf: Export cnum_umin/umax() helpers for netronome driver	2026-04-27 10:09:48 -07:00
cnum.c	bpf: representation and basic operations on circular numbers	2026-04-24 18:14:17 -07:00
const_fold.c	bpf: Extend liveness analysis to track stack argument slots	2026-05-13 09:27:31 -07:00
core.c	bpf, x86: Make sure allocation in arch_bpf_trampoline_size() is writable	2026-07-22 17:27:10 +02:00
cpumap.c	bpf: Add missing XDP_ABORTED handling in cpumap	2026-03-03 08:37:21 -08:00
cpumask.c	bpf: Require a BPF cpumask for bpf_cpumask_populate()	2026-07-12 01:52:36 +02:00
crypto.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
devmap.c	bpf: Run generic devmap egress prog on private skb	2026-06-12 18:21:01 -07:00
disasm.c	bpf: Mask pseudo pointer values in verifier logs	2026-06-25 17:59:04 -07:00
disasm.h
dispatcher.c	bpf: dispatcher: Allocate bpf_dispatcher->rw_image with vzalloc()	2026-07-22 17:26:39 +02:00
dmabuf_iter.c	bpf: Fix truncated dmabuf iterator reads	2025-12-09 23:48:34 -08:00
fixups.c	bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn	2026-07-19 18:26:40 +02:00
hashtab.c	bpf: Cancel special fields on map value recycle	2026-06-09 21:23:11 -07:00
helpers.c	bpf: Mark existing lock-safe kfuncs with KF_SPINLOCK_SAFE	2026-08-06 10:58:04 +02:00
inode.c	bpf-next-7.2	2026-06-17 09:18:14 +01:00
Kconfig	bpf: Update the bpf_prog_calc_tag to use SHA256	2025-09-18 19:10:20 -07:00
kmem_cache_iter.c	bpf: Add open coded version of kmem_cache iterator	2024-11-01 11:08:32 -07:00
link_iter.c	bpf: Clean up individual BTF_ID code	2025-07-16 18:34:42 -07:00
liveness.c	bpf: Fix arg_track_join log to use sa prefix for stack arg slots	2026-05-16 17:46:16 -07:00
local_storage.c	bpf: fix end-of-list detection in cgroup_storage_get_next_key()	2026-04-05 18:45:05 -07:00
log.c	bpf: Refactor object relationship tracking and fix dynptr UAF bug	2026-06-01 18:31:41 -07:00
lpm_trie.c	bpf: Allow LPM map access from sleepable BPF programs	2026-06-09 12:42:22 -07:00
Makefile	bpf: representation and basic operations on circular numbers	2026-04-24 18:14:17 -07:00
map_in_map.c	bpf: Reject exclusive maps as inner maps in map-in-map	2026-06-01 18:36:40 -07:00
map_in_map.h	bpf: Add map and need_defer parameters to .map_fd_put_ptr()	2023-12-04 17:50:26 -08:00
map_iter.c	bpf: Implement iteration ops for resizable hashtab	2026-06-05 08:00:08 -07:00
memalloc.c	bpf: Retire rcu_trace_implies_rcu_gp()	2026-04-07 12:24:49 -07:00
mmap_unlock_work.h	bpf: Fix mmap_lock leak in irq_work path	2026-08-08 10:25:36 +02:00
mprog.c
net_namespace.c	bpf: Fix potential UAF in bpf_netns_link_update_prog	2026-07-30 15:28:46 -07:00
offload.c	bpf: Fix use-after-free in offloaded map/prog info fill	2026-04-09 13:24:32 -07:00
percpu_freelist.c	bpf: Convert percpu_freelist.c to rqspinlock	2025-03-19 08:03:05 -07:00
percpu_freelist.h	bpf: Convert percpu_freelist.c to rqspinlock	2025-03-19 08:03:05 -07:00
prog_iter.c	bpf: Clean up individual BTF_ID code	2025-07-16 18:34:42 -07:00
queue_stack_maps.c	bpf: Zero queue and stack outputs on lock failure	2026-07-21 18:55:48 +02:00
range_tree.c	bpf: arena: Reintroduce memcg accounting	2026-01-02 14:31:59 -08:00
range_tree.h	bpf: Introduce range_tree data structure and use it in bpf arena	2024-11-13 13:52:45 -08:00
relo_core.c	bpf: Remove custom build rule	2024-08-30 08:55:26 -07:00
reuseport_array.c	bpf: Use sockfd_put() helper	2024-08-30 08:57:47 -07:00
ringbuf.c	bpf: Rename ARG_CONST_SIZE{,_OR_ZERO} to ARG_MEM_SIZE{,_OR_ZERO}	2026-08-03 00:29:14 +02:00
rqspinlock.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc7	2026-08-07 23:04:17 +02:00
rqspinlock.h	rqspinlock: Protect waiters in queue from stalls	2025-03-19 08:03:05 -07:00
stackmap.c	bpf: Fix mmap_lock leak in irq_work path	2026-08-08 10:25:36 +02:00
states.c	bpf: Preserve pointer spill metadata during half-slot cleanup	2026-06-22 13:39:34 -07:00
stream.c	bpf: Add bpf_stream_print_stack stack dumping kfunc	2026-02-03 10:41:16 -08:00
syscall.c	bpf: Generate kfunc argument prototype at add-call time	2026-08-03 00:31:26 +02:00
sysfs_btf.c	Driver core changes for 6.17-rc1	2025-07-29 12:15:39 -07:00
task_iter.c	bpf: Fix mmap_lock leak in irq_work path	2026-08-08 10:25:36 +02:00
tcx.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
tnum.c	bpf: Simplify tnum_step()	2026-03-24 08:45:29 -07:00
token.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
trampoline.c	bpf: Log error code on trampoline unlink failure	2026-07-30 16:29:03 -07:00
verifier.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc7	2026-08-07 23:04:17 +02:00