Commit de020dc8049b for kernel

commit de020dc8049bfb2b22e3b6d99c031feb2e22d112
Author: Ömer Mete Kaya <omermetekaya0@gmail.com>
Date:   Tue Sep 29 11:10:34 2026 +0300

    bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()

    bpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration
    to be disabled. All callers of rhtab_delete_elem() disable migration
    except __rhtab_map_lookup_and_delete_batch(), which calls it under
    rcu_read_lock() only.

    On CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or
    migration, so the task can migrate between CPUs during the delete loop,
    causing this_cpu_ptr() to trigger:

      BUG: using smp_processor_id() in preemptible [00000000] code

    Fix by wrapping the delete loop in migrate_disable()/migrate_enable()
    in __rhtab_map_lookup_and_delete_batch(), matching the migration
    protection that the other callers already provide.

    Fixes: 818e00848227 ("bpf: Implement iteration ops for resizable hashtab")
    Reported-by: syzbot+fd7e415d891073b83e1f@syzkaller.appspotmail.com
    Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
    Link: https://patch.msgid.link/20260929081609.557899-1-omermetekaya0@gmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=fd7e415d891073b83e1f

diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 548eb1cc7c45..13a2356c84cf 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -3374,8 +3374,10 @@ static int __rhtab_map_lookup_and_delete_batch(struct bpf_map *map,
 	}

 	if (do_delete) {
+		migrate_disable();
 		for (i = 0; i < total; i++)
 			rhtab_delete_elem(rhtab, del_elems[i], NULL, 0);
+		migrate_enable();
 	}

 	rcu_read_unlock();