Re: [PATCH bpf-next v4 8/8] selftests/bpf: Add arena allocation race tests

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] bpf: bpf_alloc_page() leaks uninitialized kernel memory to user space
--

commit 367216c19f195164e634a02e469d1a5439a1941c
Author: Emil Tsalapatis <emil@etsalapatis.com>

    selftests/bpf: Add arena allocation race tests
    
    Add selftests for arena allocation, teardown and fault races.

>     Cover unavailable ranges and kernel/user mapping coherence during
>     synchronous and deferred frees and concurrent faults.

[Severity: Critical]
While testing concurrent faults, does the allocation fallback path leak
uninitialized kernel memory to user space?

Looking at kernel/bpf/syscall.c:bpf_alloc_page(), it omits the __GFP_ZERO flag
on the fallback path:

	if (!sleepable || !can_alloc_pages())
		return alloc_pages_nolock(__GFP_ACCOUNT, nid, 0);

When preallocation fails in kernel/bpf/arena.c:arena_vm_fault(), the fault
handler falls back to the non-sleepable allocator:

	new_page = bpf_alloc_page(map->numa_node, false);

When sleepable preallocation fails due to memory pressure, or when a
non-sleepable BPF program allocates arena pages, the non-sleepable allocator
returns an uninitialized page.

Since the BPF arena is memory-mapped into user space, this allows
unprivileged users to read stale physical memory contents. Furthermore, on
PREEMPT_RT kernels, can_alloc_pages() is always false, so every arena
allocation unconditionally leaks uninitialized memory.

Also, regarding the behavior of concurrent faults, transiently missing pages
appear to correctly return VM_FAULT_NOPAGE or trigger a retry rather than
causing a fatal signal. In kernel/bpf/arena.c:arena_vm_fault():

	if (ret == -EAGAIN) {
		/* Non-retryable GUP callers recheck the PTE on NOPAGE. */
		if (!(vmf->flags & FAULT_FLAG_ALLOW_RETRY)) {
			fault_ret = VM_FAULT_NOPAGE;
			goto out_err_locked_memcg;
		}

Is the premise that concurrent faults cause a SIGBUS crash inaccurate?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014233442.8392-1-emil@etsalapatis.com?part=8