[PATCH bpf-next v2 0/7] bpf: Fix arena memory incoherence

[Emil Tsalapatis <emil@etsalapatis.com>]

Setting up arena memory for a task currently requires two operations:
Adjusting its range tree, used for tracking which memory is allocated;
and adjusting its page tables/flushing its TLB state. These operations
cannot happen atomically because their critical sections do not nest.
This lack of atomicity is the source of two bugs that can lead to
incoherence between different users of the same arena, wherein they
observe different pages for the same address.

Address the problem by more finely tracking the state of each address.
Expand the range tree used for address state tracking with a third
state, used to denote whether an address range is unavailable, either
because it is being freed or because it is being populated by a VM
fault. Use this extra state in the arena page freeing/fault logic
to ensure that operations on a single address properly serialize.

Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
Cc: Puranjay Mohan <puranjay@kernel.org>

v1 -> v2 (https://lore.kernel.org/bpf/20260902070239.16968-1-emil@etsalapatis.com/)

- Use __range_iter_next() in is_range_tree_set() (bot-ci)
- Move -EAGAIN handling to the patch where the errno is introduced (bot-ci)
- Add refactoring patch for (Puranjay)
- Avoid leaking unavailable range tree nodes with atomic mark_available
  operation()
- Avoid retries on res spinlock locking for -EDEADLK (Puranjay)

---

Emil Tsalapatis (7):
  bpf: Update is_range_tree_set to work for consecutive ranges
  bpf: Track availability information for ranges in range tree
  bpf: Fix arena race between page free and alloc leading to incoherency
  bpf: Add explicit state machine for arena free spans
  bpf: Atomically update PTE and range tree in arena VM fault handler
  bpf: Avoid unavailable range leakage during arena_free_pages()
  selftests/bpf: Add arena allocation race tests

 kernel/bpf/arena.c                            | 223 +++++++++++++--
 kernel/bpf/range_tree.c                       | 237 ++++++++++++---
 kernel/bpf/range_tree.h                       |   8 +-
 .../selftests/bpf/prog_tests/arena_race.c     | 270 ++++++++++++++++++
 .../testing/selftests/bpf/progs/arena_race.c  | 159 +++++++++++
 5 files changed, 839 insertions(+), 58 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/arena_race.c
 create mode 100644 tools/testing/selftests/bpf/progs/arena_race.c

 ---

 NOTE: This version has two additional patches, one NFC one a fix for an
 issue introduced in this series while fixing another. For the former, I
 think we should keep it as a separate patch to make it more clear what
 each change does. The latter is murkier - we can avoid the temporary
 regression by spreading Patch 6 into Patches 2 and 3 if need be.

-- 
2.54.0