[PATCH bpf] bpf: Fix soft lockup in fd_array_map_free()

[PATCH bpf] bpf: Fix soft lockup in fd_array_map_free()

[Li Jinyue]

fd_array_map_free() walks all map entries to assert that the map is
empty before its memory is freed. max_entries is not bounded, and the
free runs from the bpf_map_free_deferred work item, so with a large
max_entries the scan occupies the CPU for a long time without a
scheduling point:

  watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/u8:5:8894]
  Workqueue: events_unbound bpf_map_free_deferred
   epc : fd_array_map_free+0x7c/0xea

Add cond_resched() to the loop, matching what commit 4406942e65ca
("bpf: Fix RCU stall in bpf_fd_array_map_clear()") did for
bpf_fd_array_map_clear().

Fixes: 04fd61ab36ec ("bpf: allow bpf programs to tail-call other bpf programs")
Signed-off-by: Li Jinyue <jinyue.li@linux.alibaba.com>
---
 kernel/bpf/arraymap.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 0ce26b538075..3c908373333e 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -924,8 +924,10 @@ static void fd_array_map_free(struct bpf_map *map)
 	int i;
 
 	/* make sure it's empty */
-	for (i = 0; i < array->map.max_entries; i++)
+	for (i = 0; i < array->map.max_entries; i++) {
 		BUG_ON(array->ptrs[i] != NULL);
+		cond_resched();
+	}
 
 	bpf_map_area_free(array);
 }

-- 
2.25.1

Re: [PATCH bpf] bpf: Fix soft lockup in fd_array_map_free()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] bpf: signed integer overflow in map iterators [1]
--

commit be46454b32f6f3b215fec94602410fee2a07b5c7
Author: Li Jinyue <jinyue.li@linux.alibaba.com>

bpf: Fix soft lockup in fd_array_map_free()

This commit adds a cond_resched() call to the entry check loop in
fd_array_map_free() to avoid soft lockups when freeing maps with a large
number of entries.

> diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
> index 133f189bf6d27..b975ec3c39e57 100644
> --- a/kernel/bpf/arraymap.c
> +++ b/kernel/bpf/arraymap.c
> @@ -924,8 +924,10 @@ static void fd_array_map_free(struct bpf_map *map)
>  	int i;
>  
>  	/* make sure it's empty */
> -	for (i = 0; i < array->map.max_entries; i++)
> +	for (i = 0; i < array->map.max_entries; i++) {
>  		BUG_ON(array->ptrs[i] != NULL);
> +		cond_resched();
> +	}

[Severity: Critical]
This problem wasn't introduced by this patch, but can i overflow here when
array->map.max_entries exceeds INT_MAX [1]?

Because i is a signed int compared against the unsigned u32 max_entries, a
map created with max_entries > INT_MAX (when bpf_bypass_spec_v1 is
permitted) causes i to wrap to INT_MIN after reaching INT_MAX.  The
unsigned comparison then stays true and array->ptrs[i] indexes memory at a
large negative offset.  The same signed loop counter issue also affects
bpf_array_alloc_percpu(), bpf_array_free_percpu(), and
perf_event_fd_array_release() in this file, where indexing with a negative
i corrupts or reads out-of-bounds memory.  Should i be declared as u32?

[1] https://sashiko.dev/#/bug/linux-4e93eb71-24a1-4040-b74f-c1c6d5ae58c8

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112122015.3356106-1-jinyue.li@linux.alibaba.com?part=1

Re: [PATCH bpf] bpf: Fix soft lockup in fd_array_map_free()

[Alexei Starovoitov]

On Thu Nov 12, 2026 at 12:20 PM UTC, Li Jinyue wrote:
> fd_array_map_free() walks all map entries to assert that the map is
> empty before its memory is freed. max_entries is not bounded, and the
> free runs from the bpf_map_free_deferred work item, so with a large
> max_entries the scan occupies the CPU for a long time without a
> scheduling point:
>
>   watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/u8:5:8894]
>   Workqueue: events_unbound bpf_map_free_deferred
>    epc : fd_array_map_free+0x7c/0xea

I don't think you root caused it correctly.

pw-bot: cr