Re: [PATCH bpf-next v4 6/8] bpf: Fix arena race between page free and alloc leading to incoherency

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Wed, Oct 14, 2026 at 11:34 PM Emil Tsalapatis <emil@etsalapatis.com> wrote:
> @@ -1063,23 +1147,51 @@ static void arena_free_worker(struct work_struct *work)
[...]
> +		unavail_node = range_tree_set_unavail(&arena->rt, pgoff, page_cnt);
> +		if (!IS_ERR(unavail_node)) {
> +			s->flags |= ARENA_FREE_SPAN_RESERVED;
> +			goto clear_ptes;
> +		}
> +
> +		ret = PTR_ERR(unavail_node);
> +		/* Retry without starting teardown. */
> +		if (ret == -EAGAIN || ret == -ENOMEM)
> +			continue;

v3 dropped the span here. v4 puts it back into free_spans and
the worker does schedule_work() on itself until kmalloc_nolock()
succeeds. It's __GFP_ACCOUNT and it cannot reclaim.
At memory.max the arena cannot free its pages, because it cannot
allocate a range node, and those pages are charged to the same memcg.
The kworker burns cpu in the meantime.
In arena_free_pages() -ENOMEM goes to defer: where kmalloc_nolock()
of the span fails for the same reason and the pages stay mapped until
map free. Same as v3.
The free path shouldn't allocate before the ptes are cleared.