[PATCH bpf v2 0/4] bpf: fix and improve open-coded task_vma iterator

[Puranjay Mohan <puranjay@kernel.org>]

Changelog:
v1: https://lore.kernel.org/all/20260304142026.1443666-1-puranjay@kernel.org/
Changes in v2:
- Add a preparatory patch to rename mmap_unlock_irq_work to
  bpf_iter_mm_irq_work (Mykyta)
- Fix bpf_iter_mmput() to also defer for IRQ disabled regions (Alexei)
- Fix a build issue where mmpu_async() is not available without
  CONFIG_MMU (kernel test robot)
- Reuse mmap_unlock_irq_work (after rename) for mmput (Mykyta)
- Move vma lookup (retry block) to a separate function (Mykyta)

This series fixes the mm lifecycle handling in the open-coded task_vma
BPF iterator and switches it from mmap_lock to per-VMA locking to reduce
contention. It then fixes a deadlock that is caused by holding locks
accross the body of the iterator where faulting is allowed.

Patch 1 renames mmap_unlock_irq_work to bpf_iter_mm_irq_work so it is
generic enough to be used by Patch 2 for mmput_async().

Patch 2 fixes a missing mmget() that allows the mm_struct to be freed
before the iterator takes mmap_lock. It adds mmget_not_zero() and
introduces an NMI/IRQ-safe mmput path using per-CPU irq_work, following the
existing mmap_unlock irq_work pattern.

Patch 3 switches from holding mmap_lock for the entire iteration to
per-VMA locking via lock_vma_under_rcu(). This still doesn't fix the
deadlock problem because holding the per-vma lock for the whole
iteration can still cause lock ordering issues when a faultable helper
is called in the body of the iterator.

Patch 4 resolves the lock ordering problems caused by holding the
per-VMA lock or the mmap_lock (not applicable after patch 2) across BPF
program execution. It snapshots VMA fields under the lock, then drops
the lock before returning to the BPF program. File references are
managed via get_file()/fput() across iterations.

Puranjay Mohan (4):
  bpf: rename mmap_unlock_irq_work to bpf_iter_mm_irq_work
  bpf: fix mm lifecycle in open-coded task_vma iterator
  bpf: switch task_vma iterator from mmap_lock to per-VMA locks
  bpf: return VMA snapshot from task_vma iterator

 include/linux/sched/mm.h      |   2 +-
 kernel/bpf/mmap_unlock_work.h |  12 +--
 kernel/bpf/stackmap.c         |   2 +-
 kernel/bpf/task_iter.c        | 152 ++++++++++++++++++++++++++++++----
 kernel/fork.c                 |   2 +-
 5 files changed, 145 insertions(+), 25 deletions(-)


base-commit: 1f318b96cc84d7c2ab792fcc0bfd42a7ca890681
-- 
2.47.3