From: Noorain Eqbal <nooraineqbal@gmail.com> mainline inclusion from mainline-v6.18-rc4 commit 4e9077638301816a7d73fa1e1b4c1db4a7e3b59c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID95VB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work complete before freeing the buffer. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2617fc732430968b45d2 Tested-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com Signed-off-by: Noorain Eqbal <nooraineqbal@gmail.com> Link: https://lore.kernel.org/r/20251020180301.103366-1-nooraineqbal@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Conflicts: kernel/bpf/ringbuf.c [To avoid -Wdeclaration-after-statement warning, move irq_work_sync() after the declaration] Signed-off-by: Tengda Wu <wutengda2@huawei.com> --- kernel/bpf/ringbuf.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index 984f4772a01e..3cc55c268137 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -207,6 +207,8 @@ static void bpf_ringbuf_free(struct bpf_ringbuf *rb) struct page **pages = rb->pages; int i, nr_pages = rb->nr_pages; + irq_work_sync(&rb->work); + vunmap(rb); for (i = 0; i < nr_pages; i++) __free_page(pages[i]); -- 2.34.1