Re: [PATCH bpf-next v3 1/4] bpf: Cancel special fields in resizable hashtab on recycle

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing bpf_obj_free_fields() when overwriting a map value in rhtab_map_update_existing(), violating the BPF-001 guideline.
--

commit a386d962d0ebafb2260b7ce5bf02d3879316b1e8
Author: Yuan Chen <chenyuan@kylinos.cn>
bpf: Cancel special fields in resizable hashtab on recycle

This patch updates the resizable hashtab to use bpf_obj_cancel_fields()
instead of eagerly calling bpf_obj_free_fields() on recycle and update
paths. This is intended to prevent running kptr destructors in NMI context.

> diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
> index d40cb5dd446ca..aaedda3730f37 100644
> --- a/kernel/bpf/hashtab.c
> +++ b/kernel/bpf/hashtab.c

[ ... ]

> @@ -3022,10 +3013,12 @@ static long rhtab_map_update_existing(struct bpf_map *map, struct rhtab_elem *el
>  	 * BPF_F_LOCK, matching arraymap semantics.
>  	 *
>  	 * copy_map_value() skips special-field offsets, so old timers/
> -	 * kptrs/etc. still sit in the slot. Cancel them after the copy
> -	 * to match arraymap's update semantics.
> +	 * kptrs/etc. still sit in the slot. Cancel the NMI-safe ones after
> +	 * the copy to match arraymap's update semantics; referenced kptrs
> +	 * stay attached and are destroyed by rhtab_mem_dtor().
>  	 */
> -	rhtab_check_and_free_fields(rhtab, elem);
> +	bpf_obj_cancel_fields(&rhtab->map,
> +			      rhtab_elem_value(elem, rhtab->map.key_size));

[Severity: High]
Does replacing this cleanup cause a resource leak during map updates?

According to the BPF subsystem guidelines, when copy_map_value() overwrites
an existing map value, bpf_obj_free_fields() must be called to release
resources held by the old value. 

Since the patch removes the underlying bpf_obj_free_fields() call in
rhtab_map_update_existing() and substitutes it with bpf_obj_cancel_fields(),
it appears kptr references might leak when a map value is updated in place.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901062845.1379760-1-chenyuan_fl@163.com?part=1