From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: <nicholasfvelten@gmail.com>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Andrii Nakryiko" <andrii@kernel.org>,
"Eduard Zingerman" <eddyz87@gmail.com>,
"Kumar Kartikeya Dwivedi" <memxor@gmail.com>,
"Martin KaFai Lau" <martin.lau@linux.dev>,
"Song Liu" <song@kernel.org>,
"Yonghong Song" <yonghong.song@linux.dev>,
"Jiri Olsa" <jolsa@kernel.org>,
"Emil Tsalapatis" <emil@etsalapatis.com>,
"Ihor Solodrai" <ihor.solodrai@linux.dev>
Cc: <bpf@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<syzbot+1ea4f564bf6f1f3d1dc4@syzkaller.appspotmail.com>
Subject: Re: [PATCH bpf-next] bpf: Annotate data races on bpf_lru_node type
Date: Fri, 16 Oct 2026 16:06:44 +0000 [thread overview]
Message-ID: <DM6E405GXJXY.1PEDGW93RMMYO@gmail.com> (raw)
In-Reply-To: <20261013-fix-lru-node-type-kcsan-v1-1-0b743f5af2f3@gmail.com>
On Tue, Oct 13, 2026 at 11:00 PM Nicholas Velten via B4 Relay <devnull+nicholasfvelten.gmail.com@kernel.org> wrote:
> Both races are benign: the type is a single byte, the sanity check only
[...]
> Fixes: 3a08c2fd7634 ("bpf: LRU List")
It's not a fix. There is nothing to backport. Drop the tag.
> @@ -298,7 +298,7 @@ static void bpf_lru_list_push_free(struct bpf_lru_list *l,
> {
> unsigned long flags;
>
> - if (WARN_ON_ONCE(IS_LOCAL_LIST_TYPE(node->type)))
> + if (WARN_ON_ONCE(IS_LOCAL_LIST_TYPE(READ_ONCE(node->type))))
> return;
__bpf_lru_node_move() called few lines below does the same
WARN_ON_ONCE(IS_LOCAL_LIST_TYPE(node->type)) under l->lock.
Remove this check instead of annotating it.
> @@ -357,7 +357,7 @@ static void __local_list_add_pending(struct bpf_lru *lru,
> {
> *(u32 *)((void *)node + lru->hash_offset) = hash;
> node->cpu = cpu;
> - node->type = BPF_LRU_LOCAL_LIST_T_PENDING;
> + WRITE_ONCE(node->type, BPF_LRU_LOCAL_LIST_T_PENDING);
The node in push_free is not in the htab anymore, so del_from_htab()
fails and shrink or steal cannot take it.
Only flush and rotate can change its type, which is
__bpf_lru_node_move_in() and __bpf_lru_node_move().
Here and in the other three places the node has one owner and
nobody is reading its type. No need for WRITE_ONCE.
pw-bot: cr
prev parent reply other threads:[~2026-10-16 16:06 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-14 2:00 [PATCH bpf-next] bpf: Annotate data races on bpf_lru_node type Nicholas Velten
2026-10-14 2:00 ` Nicholas Velten via B4 Relay
2026-10-14 2:53 ` bot+bpf-ci
2026-10-16 16:06 ` Alexei Starovoitov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DM6E405GXJXY.1PEDGW93RMMYO@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=nicholasfvelten@gmail.com \
--cc=song@kernel.org \
--cc=syzbot+1ea4f564bf6f1f3d1dc4@syzkaller.appspotmail.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.