Ring buffer positions are unsigned long counters and can wrap on 32-bit systems. __bpf_ringbuf_reserve() stops advancing pending_pos after producer_pos wraps because it compares the counters by magnitude. Compare the positions for equality instead. The pending position cannot logically move ahead of the producer position. Fixes: cfa1a2329a69 ("bpf: Fix overrunning reservations in ringbuf") Reported-by: Sashiko Closes: https://lore.kernel.org/bpf/20260614020552.022A11F000E9@smtp.kernel.org/ Assisted-by: Codex:gpt-5.5 Signed-off-by: Tamir Duberstein --- kernel/bpf/ringbuf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index 35ae64ade36b..909880031fd3 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -482,7 +482,8 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) prod_pos = rb->producer_pos; new_prod_pos = prod_pos + len; - while (pend_pos < prod_pos) { + /* Positions wrap; pending_pos cannot logically pass producer_pos. */ + while (pend_pos != prod_pos) { hdr = (void *)rb->data + (pend_pos & rb->mask); hdr_len = READ_ONCE(hdr->len); if (hdr_len & BPF_RINGBUF_BUSY_BIT) -- 2.55.0.rc0.159.gbe5d7338c2