Re: [PATCH bpf-next v4 0/8] bpf: Fix arena memory incoherence

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Fri Oct 16, 2026 at 12:03 AM UTC, Emil Tsalapatis wrote:
> On Wed Oct 14, 2026 at 11:34 PM UTC, Emil Tsalapatis wrote:
>> Setting up arena memory for a task currently requires two operations:
>> Adjusting its range tree, used for tracking which memory is allocated;
>> and adjusting its page tables/flushing its TLB state. These operations
>> cannot happen atomically because their critical sections do not nest.
>> This lack of atomicity is the source of two bugs that can lead to
>> incoherence between different users of the same arena, wherein they
>> observe different pages for the same address.
>>
>> Address the problem by more finely tracking the state of each address.
>> Expand the range tree used for address state tracking with a third
>> state, used to denote whether an address range is unavailable, either
>> because it is being freed or because it is being populated by a VM
>> fault. Use this extra state in the arena page freeing/fault logic
>> to ensure that operations on a single address properly serialize.
>>
>> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
>> Cc: Puranjay Mohan <puranjay@kernel.org>
>
> I also have an alternative fix that is way simpler at the cost of holding
> the arena lock for longer during frees. I think it's a perfectly acceptable
> tradeoff since applications are expected to leave off actual page allocation/
> freeing to the allocator, and the allocator shouldn't be constantly churning
> the mapping with kfunc calls.

Sorry for the double email, forgot to actually add the link to the patchset
(just posting the link for now to avoid having two parallel extant versions here):

https://github.com/etsal/linux/tree/arena_race

>
>>
>> v3 -> v4 (https://lore.kernel.org/bpf/20260923191125.5311-1-emil@etsalapatis.com/)
>>
>> - Add per-arena anonymous mappings and associate pages with them
>> - Return VM_FAULT_LOCKED and let generic MM install user PTEs; wait
>>   for locked fault pages before TLB flushing and zapping (Alexei).
>> - Add mutual exclusion between arena free and fault operations to
>>   prevent incoherency.
>> - Return VM_FAULT_NOPAGE for non-retryable GUP faults when progress is
>>   impossible.
>> - Stop and drain self-requeueing deferred frees before map teardown.
>> - Track ownership of unavailable ranges independently of free progress
>>   and retry worker reservations on -ENOMEM without starting teardown.
>> - Make arena free span state machine explicit.
>>
>> v2 -> v3 (https://lore.kernel.org/bpf/20260923061425.7045-1-emil@etsalapatis.com/)
>>
>> - Rebase on bpf-next and resolve conflicts
>> - Fold in the atomic mark_available range tree operation into initial
>>   fix patches
>>
>> v1 -> v2 (https://lore.kernel.org/bpf/20260902070239.16968-1-emil@etsalapatis.com/)
>>
>> - Use __range_iter_next() in is_range_tree_set() (bot-ci)
>> - Move -EAGAIN handling to the patch where the errno is introduced (bot-ci)
>> - Add refactoring patch for (Puranjay)
>> - Avoid leaking unavailable range tree nodes with atomic mark_available
>>   operation()
>> - Avoid retries on res spinlock locking for -EDEADLK (Puranjay)
>>
>>
>> Emil Tsalapatis (8):
>>   bpf: Use mapping tree to zap arena VMAs
>>   bpf: Associate arena pages with their mapping
>>   bpf: arena: Stop deferred frees before map teardown
>>   bpf: Update is_range_tree_set to work for consecutive ranges
>>   bpf: Track availability information for ranges in range tree
>>   bpf: Fix arena race between page free and alloc leading to incoherency
>>   bpf: Synchronize arena page faults with page freeing
>>   selftests/bpf: Add arena allocation race tests
>>
>>  include/linux/bpf.h                           |   1 +
>>  kernel/bpf/arena.c                            | 452 ++++++++++++++----
>>  kernel/bpf/range_tree.c                       | 240 ++++++++--
>>  kernel/bpf/range_tree.h                       |   7 +-
>>  kernel/bpf/syscall.c                          |   2 +
>>  .../selftests/bpf/prog_tests/arena_race.c     | 285 +++++++++++
>>  .../testing/selftests/bpf/progs/arena_race.c  | 159 ++++++
>>  7 files changed, 1013 insertions(+), 133 deletions(-)
>>  create mode 100644 tools/testing/selftests/bpf/prog_tests/arena_race.c
>>  create mode 100644 tools/testing/selftests/bpf/progs/arena_race.c