[PATCH bpf-next v3 0/4] bpf: Cancel special fields in resizable hashtab on recycle

[chenyuan_fl@163.com]

From: Yuan Chen <chenyuan@kylinos.cn>

v3 addresses Mykyta's review of v2 [3]. Both comments concern patch 1:

  1. "Could you please double check if this is needed at all? I think
     bpf_map_free_internal_structs() going to reset special fields to 0,
     so immediate reuse by __bpf_async_init(), bpf_task_work_schedule()
     correctly identifies fresh fields."
     -> Correct: bpf_obj_cancel_fields() resets the timer/workqueue/
     task_work slots in place (xchg to NULL in bpf_async_cancel_and_free()
     and bpf_task_work_cancel_and_free()), so no re-initialization is
     needed on reuse. rhtab_init_map_value() is dropped entirely; the
     element alloc path now matches htab's non-prealloc path
     (alloc_htab_elem()), which also performs no explicit init.

  2. "Let's directly call bpf_obj_cancel_fields() here and below, so it
     is consistent with htab."
     -> Done: the rhtab_cancel_fields() wrapper is removed and
     rhtab_delete_elem()/rhtab_map_update_existing() call
     bpf_obj_cancel_fields() directly.

The resizable hashtab still eagerly calls bpf_obj_free_fields() on
element delete/replace, which runs kptr destructors from the caller's
execution context (unsafe in NMI). This follows the existing discussion
on RHash special-field recycling (Nuoqi Gui's series [2] and the review
[1]): patch 1 applies the cancel semantics like hash/array maps
(a3a81d247651); patch 2 fixes a program-BTF use-after-free in the
mem-alloc destructor found while testing; patches 3-4 add regression
tests (NMI update, and per-field delete/re-insert cycles).

Changes since v2 (all from Mykyta's review [3]):

  * Drop rhtab_init_map_value(): bpf_obj_cancel_fields() resets the
    timer/workqueue/task_work slots to zero on delete, fresh elements
    come zeroed from the bpf mem allocator, and kptr slots must stay
    untouched, so no re-initialization is needed (matching htab's
    non-prealloc path).
  * Call bpf_obj_cancel_fields() directly instead of a rhtab-specific
    wrapper, consistent with htab.

[1] https://lore.kernel.org/bpf/DKEVG8ZVJDDQ.2G40FTOIZKU57@gmail.com/
[2] https://lore.kernel.org/bpf/20260726-f01-23-rhash-cancel-bpf-next-v1-0-6e5e1131d885@mails.tsinghua.edu.cn/
[3] https://lore.kernel.org/bpf/0560a24d-2cf9-4e5b-aa61-580af1e56de1@gmail.com/

Yuan Chen (4):
  bpf: Cancel special fields in resizable hashtab on recycle
  bpf: Fix use-after-free of program BTF in mem-alloc destructor
  selftests/bpf: Test rhtab kptr recycle from NMI context
  selftests/bpf: Test rhtab special-field combinations

 kernel/bpf/hashtab.c                               |  98 +++++-
 .../selftests/bpf/prog_tests/rhtab_fields.c        | 337 ++++++++++++++++++
 .../testing/selftests/bpf/prog_tests/rhtab_kptr.c  | 184 ++++++++++
 tools/testing/selftests/bpf/progs/rhtab_fields.c   | 378 +++++++++++++++++++++
 tools/testing/selftests/bpf/progs/rhtab_kptr.c     | 146 ++++++++
 tools/testing/selftests/bpf/rhtab_fields_common.h  |  19 ++
 tools/testing/selftests/bpf/rhtab_kptr_common.h    |   6 +
 7 files changed, 1152 insertions(+), 16 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/rhtab_fields.c
 create mode 100644 tools/testing/selftests/bpf/prog_tests/rhtab_kptr.c
 create mode 100644 tools/testing/selftests/bpf/progs/rhtab_fields.c
 create mode 100644 tools/testing/selftests/bpf/progs/rhtab_kptr.c
 create mode 100644 tools/testing/selftests/bpf/rhtab_fields_common.h
 create mode 100644 tools/testing/selftests/bpf/rhtab_kptr_common.h

--
2.54.0