Re: [PATCH bpf-next v3 3/6] bpf: Fix arena race between page free and alloc leading to incoherency

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Wed, Sep 23, 2026 at 07:11 PM Emil Tsalapatis <emil@etsalapatis.com> wrote:
> Solve this ABA problem by preventing range reallocation until
> TLB invalidation/unmapping is complete. First, mark the range
> freed but unavailable. Afterwards, drop the spinlock and
> flush the kernel TLB and zap user page tables. Then pick up
> the lock again and mark the ranges as available once again,
> completing the free operation.

The range is allocated in the range tree before the free.
can we keep it allocated until flush_tlb_kernel_range() and
zap_pages() are done and call range_tree_set() only after that ?
bpf_arena_reserve_pages() creates the same 'allocated without pages'
state. arena_vm_fault() shouldn't populate such range, I think.
Then there is no need for the 3rd state in the range tree.

[...]
> +		unavail_node = range_tree_set_unavail(&arena->rt, pgoff, page_cnt);
> +		if (IS_ERR(unavail_node)) {
> +			ret = PTR_ERR(unavail_node);
> +			/* Kick off another attempt at the end of this call. */
> +			if (ret == -EAGAIN) {
> +				llist_add(pos, &arena->free_spans);
> +				retry = true;
> +				continue;
> +			}
> +
> +			/*
> +			 * An -ENOMEM failure is the same failure mode as in
> +			 * the defer: path of arena_free_pages(). Do not treat
> +			 * the leak as a bug.
> +			 */
> +			if (ret != -ENOMEM)
> +				WARN_ON_ONCE(ret);
> +
> +			kfree_nolock(s);
> +			continue;
> +		}

This makes it worse.
Unavailable ranges don't merge, so range_tree_set_unavail() always
allocates a node. When kmalloc_nolock() fails the span is dropped
before the ptes are cleared and the pages stay mapped until map free.
Today the worker unmaps and frees the pages and range_tree_set()
failure costs only the address range.

pw-bot: cr