Re: [PATCH 2/5] bpf: Expose pinned arenas as sized bpffs files

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] bpf: unreachable overlap calculation logic for exported arenas in zap_pages()
--

commit 0faffaea3054cd9867f7c5fb15288b7583784671
Author: Andrea Righi <arighi@nvidia.com>

bpf: Expose pinned arenas as sized bpffs files

This commit introduces the BPF_F_ARENA_EXPORT flag to expose pinned BPF
arenas as sized files in bpffs, allowing userspace programs to mmap them.
Map fault handling and page zapping are updated to support disjoint slice
mappings using file offsets. It also mandates that exported arenas use the
BPF_F_ARENA_NO_FREE flag.

> diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c
> --- a/kernel/bpf/arena.c
> +++ b/kernel/bpf/arena.c
[ ... ]
> @@ -881,8 +917,14 @@ static void zap_pages(struct bpf_arena *arena, long uaddr, long page_cnt)
>  		 */
>  		vma = find_vma(mm, vm_start);
>  		if (vma && vma->vm_start == vm_start &&
> -		    vma->vm_file && vma->vm_file->private_data == &arena->map)
> -			zap_vma_range(vma, uaddr, size);
> +		    vma->vm_file && vma->vm_file->private_data == &arena->map) {
> +			vma_start = (u64)vma->vm_pgoff << PAGE_SHIFT;
> +			vma_end = vma_start + vma->vm_end - vma->vm_start;
> +			if (start < vma_end && end > vma_start)
> +				zap_vma_range(vma, vma->vm_start +
> +					      (max(start, vma_start) - vma_start),
> +					      min(end, vma_end) - max(start, vma_start));
> +		}

[Severity: Low]
Is this overlap calculation in zap_pages() reachable for exported arenas?

The offset calculation here uses vma->vm_pgoff to compute overlaps for
partial page zaps. This specific offset math is only strictly necessary
for exported mappings, because canonical arena VMAs always have a zero
page offset.

However, zap_pages() is exclusively called during page freeing operations
such as bpf_arena_free_pages() or via arena_free_worker().

Because arena_map_alloc() requires exported arenas to have the
BPF_F_ARENA_NO_FREE flag set, and bpf_arena_free_pages() explicitly returns
early when this flag is present, BPF programs can never free pages in
exported arenas.

Could this make the newly added partial zap logic using vma->vm_pgoff
completely dead code?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261010224902.1232178-1-arighi@nvidia.com?part=2