[PATCH bpf] bpf: Fix smp_processor_id() warning in rhtab_delete_elem()

[Ömer Mete Kaya]

bpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires preemption
to be disabled. In rhtab_delete_elem(), this call happens after
bpf_enable_instrumentation(), so preemption is re-enabled at that
point and this_cpu_ptr() triggers:

  BUG: using smp_processor_id() in preemptible [00000000] code

Fix by moving all post-delete cleanup — rhtab_read_elem_value(),
check_and_init_map_value(), bpf_obj_cancel_fields(), and
bpf_mem_cache_free_rcu() — inside the bpf_disable_instrumentation()
section, before bpf_enable_instrumentation() is called.

This is consistent with __htab_map_lookup_and_delete_batch() which
wraps the entire batch operation including element freeing under
bpf_disable_instrumentation().

Fixes: 6905f8601298 ("bpf: Allow special fields in resizable hashtab")
Reported-by: syzbot+fd7e415d891073b83e1f@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=fd7e415d891073b83e1f
Signed-off-by: Ömer Mete Kaya <omermetekaya0@xxxxxxxxx>
---
Tested with syzkaller:
- Before the fix: the reported warning was reproduced reliably.
- After the fix: the warning was no longer reproducible.

 kernel/bpf/hashtab.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index f744a42bb813..8cc07e54daaa 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -2979,19 +2979,18 @@ static int rhtab_delete_elem(struct bpf_rhtab *rhtab, struct rhtab_elem *elem, v
 	else
 		err = rhashtable_remove_fast(&rhtab->ht, &elem->node, rhtab_params);

-	bpf_enable_instrumentation();
-
-	if (err)
-		return err;
-
-	if (copy) {
-		rhtab_read_elem_value(&rhtab->map, copy, elem, flags);
-		check_and_init_map_value(&rhtab->map, copy);
+	if (!err) {
+		if (copy) {
+			rhtab_read_elem_value(&rhtab->map, copy, elem, flags);
+			check_and_init_map_value(&rhtab->map, copy);
+		}
+		bpf_obj_cancel_fields(&rhtab->map,
+				      rhtab_elem_value(elem, rhtab->map.key_size));
+		bpf_mem_cache_free_rcu(&rhtab->ma, elem);
 	}
-	bpf_obj_cancel_fields(&rhtab->map,
-			      rhtab_elem_value(elem, rhtab->map.key_size));
-	bpf_mem_cache_free_rcu(&rhtab->ma, elem);
-	return 0;
+
+	bpf_enable_instrumentation();
+	return err;
 }

 static long rhtab_map_delete_elem(struct bpf_map *map, void *key)
--
2.55.0