6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jiri Olsa [ Upstream commit 15f1bd8574662f1b7b26aaa2e23ebf4066f0117d ] The get_perf_callchain call needs disabled preemption plus we need it disabled as long as we access its returned trace entries buffer. Note the bpf_get_stackid_pe function is executed already with preemption disabled. Fixes: d5a3b1f69186 ("bpf: introduce BPF_MAP_TYPE_STACK_TRACE") Reported-by: Tao Chen Signed-off-by: Jiri Olsa Signed-off-by: Andrii Nakryiko Cc: stable@vger.kernel.org Link: https://lore.kernel.org/bpf/20260803210149.296496-6-jolsa@kernel.org Closes: https://lore.kernel.org/bpf/20260206090653.1336687-2-chen.dylane@linux.dev/ [ adapted get_perf_callchain() to the older six-argument form ] Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- kernel/bpf/stackmap.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -374,20 +374,22 @@ BPF_CALL_3(bpf_get_stackid, struct pt_re return -EINVAL; max_depth = stack_map_calculate_max_depth(map->value_size, elem_size, flags); - trace = get_perf_callchain(regs, kernel, user, max_depth, - false, false); - if (unlikely(!trace)) - /* couldn't fetch the stack trace */ - return -EFAULT; + scoped_guard(preempt) { + trace = get_perf_callchain(regs, kernel, user, max_depth, + false, false); + if (unlikely(!trace)) + /* couldn't fetch the stack trace */ + return -EFAULT; - err = stackid_fastpath(&stackid, map, trace, flags); - if (err != -ENOENT) - return err; + err = stackid_fastpath(&stackid, map, trace, flags); + if (err != -ENOENT) + return err; - new_bucket = stackid_new_bucket(&stackid, map); - if (!new_bucket) - return -ENOMEM; + new_bucket = stackid_new_bucket(&stackid, map); + if (!new_bucket) + return -ENOMEM; + } return stackid_install(&stackid, map, new_bucket, flags); }