Re: [PATCH bpf-next v4 0/8] bpf: Fix arena memory incoherence

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Wed Oct 14, 2026 at 11:34 PM UTC, Emil Tsalapatis wrote:
> Setting up arena memory for a task currently requires two operations:
> Adjusting its range tree, used for tracking which memory is allocated;
> and adjusting its page tables/flushing its TLB state. These operations
> cannot happen atomically because their critical sections do not nest.
> This lack of atomicity is the source of two bugs that can lead to
> incoherence between different users of the same arena, wherein they
> observe different pages for the same address.
>
> Address the problem by more finely tracking the state of each address.
> Expand the range tree used for address state tracking with a third
> state, used to denote whether an address range is unavailable, either
> because it is being freed or because it is being populated by a VM
> fault. Use this extra state in the arena page freeing/fault logic
> to ensure that operations on a single address properly serialize.
>
> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
> Cc: Puranjay Mohan <puranjay@kernel.org>

I also have an alternative fix that is way simpler at the cost of holding
the arena lock for longer during frees. I think it's a perfectly acceptable
tradeoff since applications are expected to leave off actual page allocation/
freeing to the allocator, and the allocator shouldn't be constantly churning
the mapping with kfunc calls.

>
> v3 -> v4 (https://lore.kernel.org/bpf/20260923191125.5311-1-emil@etsalapatis.com/)
>
> - Add per-arena anonymous mappings and associate pages with them
> - Return VM_FAULT_LOCKED and let generic MM install user PTEs; wait
>   for locked fault pages before TLB flushing and zapping (Alexei).
> - Add mutual exclusion between arena free and fault operations to
>   prevent incoherency.
> - Return VM_FAULT_NOPAGE for non-retryable GUP faults when progress is
>   impossible.
> - Stop and drain self-requeueing deferred frees before map teardown.
> - Track ownership of unavailable ranges independently of free progress
>   and retry worker reservations on -ENOMEM without starting teardown.
> - Make arena free span state machine explicit.
>
> v2 -> v3 (https://lore.kernel.org/bpf/20260923061425.7045-1-emil@etsalapatis.com/)
>
> - Rebase on bpf-next and resolve conflicts
> - Fold in the atomic mark_available range tree operation into initial
>   fix patches
>
> v1 -> v2 (https://lore.kernel.org/bpf/20260902070239.16968-1-emil@etsalapatis.com/)
>
> - Use __range_iter_next() in is_range_tree_set() (bot-ci)
> - Move -EAGAIN handling to the patch where the errno is introduced (bot-ci)
> - Add refactoring patch for (Puranjay)
> - Avoid leaking unavailable range tree nodes with atomic mark_available
>   operation()
> - Avoid retries on res spinlock locking for -EDEADLK (Puranjay)
>
>
> Emil Tsalapatis (8):
>   bpf: Use mapping tree to zap arena VMAs
>   bpf: Associate arena pages with their mapping
>   bpf: arena: Stop deferred frees before map teardown
>   bpf: Update is_range_tree_set to work for consecutive ranges
>   bpf: Track availability information for ranges in range tree
>   bpf: Fix arena race between page free and alloc leading to incoherency
>   bpf: Synchronize arena page faults with page freeing
>   selftests/bpf: Add arena allocation race tests
>
>  include/linux/bpf.h                           |   1 +
>  kernel/bpf/arena.c                            | 452 ++++++++++++++----
>  kernel/bpf/range_tree.c                       | 240 ++++++++--
>  kernel/bpf/range_tree.h                       |   7 +-
>  kernel/bpf/syscall.c                          |   2 +
>  .../selftests/bpf/prog_tests/arena_race.c     | 285 +++++++++++
>  .../testing/selftests/bpf/progs/arena_race.c  | 159 ++++++
>  7 files changed, 1013 insertions(+), 133 deletions(-)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/arena_race.c
>  create mode 100644 tools/testing/selftests/bpf/progs/arena_race.c