Re: [PATCH bpf-next v6 1/4] bpf: Add a sleepable page allocator for map memory

[Khawar Ahemad <ahemadkhawar123@gmail.com>]

Hi,

Thanks for the careful review. After tracing the call path in full,
this finding is a false positive. Here is the evidence:

alloc_pages_nolock() is implemented as alloc_frozen_pages_nolock_noprof()
in mm/page_alloc.c. Regardless of which gfp_flags the caller passes, the
implementation unconditionally ORs in __GFP_ZERO before calling
get_page_from_freelist():

  /* mm/page_alloc.c, alloc_frozen_pages_nolock_noprof() */
  gfp_t alloc_gfp = __GFP_NOWARN | __GFP_ZERO | __GFP_NOMEMALLOC | __GFP_COMP
                  | gfp_flags;

The comment at that exact site makes the intent explicit:

  "Specify __GFP_ZERO to make sure that call to kmsan_alloc_page() below
   is safe in any context. Also zeroing the page is mandatory for
   BPF use cases."

So even though __bpf_alloc_page() passes only __GFP_ACCOUNT to
alloc_pages_nolock(), the allocator enforces __GFP_ZERO unconditionally.
The returned page is always zeroed before being handed to the caller.
There is no path through which uninitialized kernel memory can be mapped
into a BPF arena.

The API documentation in include/linux/gfp.h also states that
__GFP_ACCOUNT is the only caller-supplied flag alloc_pages_nolock()
accepts, precisely because the implementation controls all others itself.

No code change is needed.

Khawar Ahemad <ahemadkhawar123@gmail.com>