Re: [PATCH bpf-next v4 0/8] bpf: Fix arena memory incoherence

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Wed, Oct 14, 2026 at 11:34 PM Emil Tsalapatis <emil@etsalapatis.com> wrote:
> Address the problem by more finely tracking the state of each address.
> Expand the range tree used for address state tracking with a third
> state, used to denote whether an address range is unavailable, either
> because it is being freed or because it is being populated by a VM
> fault. Use this extra state in the arena page freeing/fault logic
> to ensure that operations on a single address properly serialize.

In v3 I asked to keep the range allocated until flush_tlb_kernel_range()
and zap_pages() are done instead of adding the 3rd state.
You replied that arena_vm_fault() would need a marker similar to
the 3rd state to skip such range:
https://lore.kernel.org/bpf/CABFh=a7z3pdJy6LW+Kc3sQ+chp7iun8t3x+XH2OmuSKNFN6icg@mail.gmail.com/
It doesn't. The range tree has it already.
When vmalloc_to_page() is NULL and is_range_tree_set(pgoff, 1) fails
the page is either reserved or being freed.
Return the same error as for scratch_page few lines above.
The free path does range_tree_clear() and clears ptes under the lock,
then flush, zap, and range_tree_set() at the end.
range_tree_clear() allocates only when the range sits in the middle of
a free range, so nothing is allocated before the pages are unmapped.

Disabling bpf_arena_alloc/free_pages() without BPF_F_SEGV_ON_FAULT
is not an option. Nothing in selftests, libarena or tools/sched_ext
sets that flag.

[...]
> - Add per-arena anonymous mappings and associate pages with them
> - Return VM_FAULT_LOCKED and let generic MM install user PTEs; wait
>   for locked fault pages before TLB flushing and zapping (Alexei).
> - Add mutual exclusion between arena free and fault operations to
>   prevent incoherency.

v3 was +851 lines. v4 is +1013.
On top of the 3rd state there are span flags, opref with a wait queue,
an inode per arena, page->mapping and a new bpf_map_ops callback.
These are two ordering bugs. See replies to patches 1, 2, 6, 7.

pw-bot: cr