[PATCH bpf-next v1 0/4] Close race in freeing special fields and map value

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

There exists a race across various map types where the freeing of
special fields (tw, timer, wq, kptr, etc.) can be done eagerly when a
logical delete operation is done on a map value, such that the program
which continues to have access to such a map value can recreate the
fields and cause them to leak.

The set contains fixes for this case. It is a continuation of Mykyta's
previous attempt in [0], but applies to all fields. A test is included
which reproduces the bug reliably in absence of the fixes.

  [0]: https://lore.kernel.org/bpf/20260216131341.1285427-1-mykyta.yatsenko5@gmail.com

Kumar Kartikeya Dwivedi (4):
  bpf: Register dtor for freeing special fields
  bpf: Delay freeing fields in local storage
  bpf: Retire rcu_trace_implies_rcu_gp() from local storage
  selftests/bpf: Add tests for special fields races

 include/linux/bpf_mem_alloc.h                 |   4 +
 kernel/bpf/bpf_local_storage.c                |  65 ++++----
 kernel/bpf/hashtab.c                          |  37 +++++
 kernel/bpf/memalloc.c                         |  42 +++--
 .../selftests/bpf/prog_tests/map_kptr_race.c  | 155 ++++++++++++++++++
 .../selftests/bpf/progs/map_kptr_race.c       | 145 ++++++++++++++++
 6 files changed, 403 insertions(+), 45 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/map_kptr_race.c
 create mode 100644 tools/testing/selftests/bpf/progs/map_kptr_race.c


base-commit: f620af11c27b8ec9994a39fe968aa778112d1566
-- 
2.47.3