#syz test The syzkaller report exposed a BUG: “sleeping function called from invalid context” in sock_map_delete_elem, which happens when `bpf_test_timer_enter()` disables preemption but the delete path later invokes a sleeping function while still in that context. Specifically: - The crash trace shows `bpf_test_timer_enter()` acquiring a preempt_disable path (via t->mode == NO_PREEMPT), but the symmetric release path always calls migrate_enable(), mismatching the earlier disable. - As a result, preemption remains disabled across the sock_map_delete_elem path, leading to a sleeping call under an invalid context. :contentReference[oaicite:0]{index=0} To fix this, normalize the disable/enable pairing: always use migrate_disable()/migrate_enable() regardless of t->mode. This ensures that we never remain with preemption disabled unintentionally when entering the delete path, and avoids invalid-context sleeping. Reported-by: syzbot+1f1fbecb9413cdbfbef8@syzkaller.appspotmail.com Signed-off-by: Brahmajit Das --- net/bpf/test_run.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index dfb03ee0bb62..07ffe7d92c1c 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -38,10 +38,7 @@ static void bpf_test_timer_enter(struct bpf_test_timer *t) __acquires(rcu) { rcu_read_lock(); - if (t->mode == NO_PREEMPT) - preempt_disable(); - else - migrate_disable(); + migrate_disable(); t->time_start = ktime_get_ns(); } @@ -51,10 +48,7 @@ static void bpf_test_timer_leave(struct bpf_test_timer *t) { t->time_start = 0; - if (t->mode == NO_PREEMPT) - preempt_enable(); - else - migrate_enable(); + migrate_enable(); rcu_read_unlock(); } -- 2.51.0