Re: [PATCH bpf] bpf: Fix bpf_timer callback running on a freed map

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@xxxxxxxxxx>:

On Tue, 27 Oct 2026 13:03:42 -0400 you wrote:
> From: Mani Tofigh <mt4022@xxxxxxxxxxxx>
> 
> A bpf_timer in an inner map can fire after the map has been freed, and
> bpf_timer_cb() then reads the freed map:
> 
>   [   50.709520] BUG: KASAN: slab-use-after-free in bpf_timer_cb+0x249/0x290
>   [   50.709540] Read of size 4 at addr ff11000003bc1030 by task bpftimer/72
>   ...
>   [   50.710783] Freed by task 12:
>   ...
>   [   50.710826]  bpf_map_free+0x1a2/0x380
> 
> [...]

Here is the summary with links:
  - [bpf] bpf: Fix bpf_timer callback running on a freed map
    https://git.kernel.org/bpf/bpf/c/815a0a2a40d6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html