[PATCH bpf v2] bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()

[Ömer Mete Kaya]

bpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration
to be disabled. All callers of rhtab_delete_elem() disable migration
except __rhtab_map_lookup_and_delete_batch(), which calls it under
rcu_read_lock() only.

On CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or
migration, so the task can migrate between CPUs during the delete loop,
causing this_cpu_ptr() to trigger:

  BUG: using smp_processor_id() in preemptible [00000000] code

Fix by wrapping the delete loop in migrate_disable()/migrate_enable()
in __rhtab_map_lookup_and_delete_batch(), matching the migration
protection that the other callers already provide.

Fixes: 818e00848227 ("bpf: Implement iteration ops for resizable hashtab")
Reported-by: syzbot+fd7e415d891073b83e1f@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=fd7e415d891073b83e1f
Suggested-by: Alexei Starovoitov <ast@xxxxxxxxxx>
Signed-off-by: Ömer Mete Kaya <omermetekaya0@xxxxxxxxx>
---
Changes in v2:
  - Fix root cause in __rhtab_map_lookup_and_delete_batch() with
    migrate_disable()/migrate_enable() instead of stretching
    bpf_disable_instrumentation() in rhtab_delete_elem().
  - Fix Fixes: tag to 818e00848227.
  - Fix commit message: migration disabled, not preemption.

Tested with syzkaller:
  - Before the fix: the reported warning was reproduced reliably.
  - After the fix: the warning was no longer reproducible.

 kernel/bpf/hashtab.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index f744a42bb813..2bb9ac7fc73e 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -3369,8 +3369,10 @@ static int __rhtab_map_lookup_and_delete_batch(struct bpf_map *map,
 	}

 	if (do_delete) {
+		migrate_disable();
 		for (i = 0; i < total; i++)
 			rhtab_delete_elem(rhtab, del_elems[i], NULL, 0);
+		migrate_enable();
 	}

 	rcu_read_unlock();
--
2.55.0