Re: [PATCH v6 1/4] bpf: Add a sleepable page allocator for map memory

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Pages allocated with `__GFP_ZERO` for user-space mapping (BPF Arena) lack necessary dcache flushes on cache-aliasing architectures, potentially leaking uninitialized kernel memory to user space.
--

--- Patch [1]: [PATCH v6 1/4] bpf: Add a sleepable page allocator for map memory ---
commit 50003cab10c1c00ca87711f66767e18f684829b8
Author: Jiayuan Chen <jiayuan.chen@linux.dev>

bpf: Add a sleepable page allocator for map memory

This patch adds bpf_map_alloc_page_sleepable() for callers in sleepable
contexts, such as the arena page fault handler. It avoids the non-blocking
allocator and allocates a page directly from the map's NUMA node.

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 6874ba1424af0..f9b81638e537a 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c

[ ... ]

> +/*
> + * For callers that know they run in a sleepable context, e.g. a user page
> + * fault handler. can_alloc_pages() is a conservative guess made for BPF
> + * program context - notably it is always false on PREEMPT_RT - so going
> + * through bpf_map_alloc_pages() there would needlessly pick the
> + * non-blocking allocator, which never reclaims and never engages the OOM
> + * machinery.
> + */
> +struct page *bpf_map_alloc_page_sleepable(const struct bpf_map *map)
> +{
> +	might_sleep();
> +	return alloc_pages_node(map->numa_node, BPF_PAGE_GFP, 0);

[Severity: High]
This isn't a bug introduced by this patch, but does the use of __GFP_ZERO
safely zero user-mapped pages on cache-aliasing architectures?

The __GFP_ZERO flag zeroes memory using clear_page() via the kernel's
direct mapping, which skips the dcache flush provided by functions like
clear_user_highpage().

On cache-aliasing architectures, this can cause user space to read stale data
directly from physical memory if the zeroes remain in the dcache when the
page is mapped to a different user space virtual address.

Since this function is intended for the BPF arena page fault handler to map
memory to user space, should it instead use user_alloc_needs_zeroing() and
clear_user_highpage() or folio_zero_user() rather than relying on the
__GFP_ZERO bit in BPF_PAGE_GFP?

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260825091647.81632-1-ahemadkhawar123@gmail.com?part=1