From: Alexei Starovoitov Date: Mon, 6 Apr 2026 01:37:32 +0000 (-0700) Subject: Merge branch 'bpf-fix-torn-writes-in-non-prealloc-htab-with-bpf_f_lock' X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=24dbbf8a2343d4063c370a1f25645eabc50d68c9;p=thirdparty%2Fkernel%2Flinux.git Merge branch 'bpf-fix-torn-writes-in-non-prealloc-htab-with-bpf_f_lock' Mykyta Yatsenko says: ==================== bpf: Fix torn writes in non-prealloc htab with BPF_F_LOCK A torn write issue was reported in htab_map_update_elem() with BPF_F_LOCK on hash maps. The BPF_F_LOCK fast path performs a lockless lookup and copies the value under the element's embedded spin_lock. A concurrent delete can free the element via bpf_mem_cache_free(), which allows immediate reuse. When alloc_htab_elem() recycles the same memory, it writes the value with plain copy_map_value() without taking the spin_lock, racing with the stale lock holder and producing torn writes. Patch 1 fixes alloc_htab_elem() to use copy_map_value_locked() when BPF_F_LOCK is set. Patch 2 adds a selftest that reliably detects the torn writes on an unpatched kernel. Reported-by: Aaron Esau Signed-off-by: Mykyta Yatsenko ==================== Link: https://patch.msgid.link/20260401-bpf_map_torn_writes-v1-0-782d071c55e7@meta.com Signed-off-by: Alexei Starovoitov --- 24dbbf8a2343d4063c370a1f25645eabc50d68c9