Re: [RFC PATCH bpf-next v1 03/16] bpf: Back typed arena chunks with scratch on demand

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] bpf: Use-After-Free due to missing PTE cleanup in typed_arena_teardown_cb()
--

commit 5ad8213f9e65607de0b6ea3647cc93fae67f349a
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Back typed arena chunks with scratch on demand

This patch introduces demand-paging for typed BPF arenas, where unbacked
pages fault and are populated with scratch memory. It handles the fault
recovery, marks chunks in a bitmap, and adds allocation and freeing
mechanisms for these chunks during the map's lifecycle.

> diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c
> index 9cd1b1ce434c4..c757c19323602 100644
> --- a/kernel/bpf/arena.c
> +++ b/kernel/bpf/arena.c

[ ... ]

> @@ -371,7 +396,7 @@ static int typed_arena_teardown_cb(pte_t *ptep, unsigned long addr, void *data)
>  
>  	if ((addr - (unsigned long)ta->base) & (bpf_typed_arena_chunk(ta) - 1))
>  		return 0;
> -	if (!pte_present(pte))
> +	if (!pte_present(pte) || pte_page(pte) == typed_arena_scratch_page(ta, addr))
>  		return 0;
>  	typed_arena_free_objects(ta, (void *)addr);
>  	__free_pages(pte_page(pte), typed_arena_chunk_order(ta));

[Severity: Critical]
Does this leave the kernel leaf PTEs pointing to freed memory?

This callback frees the physical pages for allocated chunks using
__free_pages(), but it doesn't appear to clear the PTEs using pte_clear()
or ptep_get_and_clear().

If a typed arena is destroyed (for example, if a BPF program load fails
after allocation), bpf_typed_arena_put() calls typed_arena_free(), which
then uses this callback. The underlying memory is freed, but the page
tables remain populated with valid mappings.

Because typed_arena_find_slice() searches for and reuses freed address
gaps, a subsequently loaded BPF program could allocate an arena of the
same size, inherit the same virtual address slice, and access these stale
PTEs to manipulate the freed memory.

> @@ -383,6 +408,10 @@ static void typed_arena_free(struct bpf_arena *arena, struct bpf_typed_arena *ta
>  	WRITE_ONCE(arena->typed_arena_mem, arena->typed_arena_mem - typed_arena_static_mem(ta));
>  	apply_to_existing_page_range(&init_mm, (unsigned long)ta->base, bpf_typed_arena_size(ta),
>  				     typed_arena_teardown_cb, ta);
> +	/* Programs may have stored kptrs into the dummy objects. */
> +	typed_arena_free_objects(ta, ta->scratch);
> +	vfree(ta->scratch);

[Severity: Critical]
Could this similarly leave stale mappings to freed scratch space?

The scratch pages are freed via vfree(), but the aliased PTEs within the
arena's kernel VM area that point to these scratch pages are never cleared
during the teardown process.

> +	kfree(ta->scratch_pages);
>  	bitmap_free(ta->chunks);
>  	bitmap_free(ta->pending);
>  	btf_put(ta->btf);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926233503.3114147-1-memxor@gmail.com?part=3