Re: [PATCH bpf-next v4 7/8] bpf: Synchronize arena page faults with page freeing

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Wed, Oct 14, 2026 at 11:34 PM Emil Tsalapatis <emil@etsalapatis.com> wrote:
> Prevent the arena VM fault handler from running in parallel with arena free
> operations. This is similar to the policy for file-backed mappings. Use a
> per-arena reference counter to exclude faults from synchronous and deferred
> page teardown, and vice versa. Faults and frees can each run concurrently
> with operations of the same type.

In v3 I suggested to lock the page, recheck vmalloc_to_page() and
return VM_FAULT_LOCKED. The recheck is missing and opref is there
instead of it.
The free path clears the pte under arena->spinlock and then does
lock_page(); unlock_page();
If arena_vm_fault() locked the page first the free waits for
finish_fault() and zap_pages() removes that pte.
If the free was first arena_vm_fault() sees different vmalloc_to_page()
under the page lock. Unlock, put and start over.
The fault holds a page ref, so the same page cannot come back.
The free path holds nothing when it gets to zap_pages(), so
mmap_read_lock() there is fine and patch 1 is not needed.
See
commit bb9b9eb0ae2e ("scsi: target: tcmu: Fix possible data corruption").
Same bug.

[...]
>  	if (!sleepable)
>  		goto defer;
> +	if (!arena_opref_get(arena, ARENA_OPREF_FREE))
> +		goto defer;

One user thread faulting on any page of the arena turns sleepable
bpf_arena_free_pages() of unrelated page into deferred one.
buddy_chunk_get() in libarena does
bpf_arena_free_pages(vaddr); bpf_arena_alloc_pages(vaddr);
The alloc fails and that vaddr is lost.
The other way around any free makes all faults in the arena spin in
VM_FAULT_RETRY, and the worker spins in schedule_work() while a fault
sleeps in alloc_pages_node(GFP_KERNEL).
Giving frees a priority over faults, as you replied to bpf-ci, makes it
even heavier.