Re: [PATCH bpf-next v4 2/8] bpf: Associate arena pages with their mapping

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: sleeping lock_page() called under PTL spinlock in existing_page_cb()
--

commit 06bc77555d3cf904ccf154edab307819785c3c2b
Author: Emil Tsalapatis <emil@etsalapatis.com>
Subject: bpf: Associate arena pages with their mapping

This commit associates arena backing pages with the arena's private mapping
and sets their page offsets. This allows the fault handler to delegate user
PTE installation to generic MM code, helping avoid races with kfunc-related
arena operations.

> diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c
> index b95ffdb14417a..650baa09fcb5a 100644
> --- a/kernel/bpf/arena.c
> +++ b/kernel/bpf/arena.c
[ ... ]
> @@ -355,6 +371,14 @@ static struct bpf_map *arena_map_alloc(union bpf_attr *attr)
>  	return ERR_PTR(err);
>  }
>  
> +static void arena_put_page(struct page *page)
> +{
> +	lock_page(page);
> +	page->mapping = NULL;
> +	unlock_page(page);
> +	__free_page(page);
> +}
> +
>  static int existing_page_cb(pte_t *ptep, unsigned long addr, void *data)
>  {
>  	struct bpf_arena *arena = data;
> @@ -378,7 +402,7 @@ static int existing_page_cb(pte_t *ptep, unsigned long addr, void *data)
>  	 * the TLB entries can stick around and continue to permit access to
>  	 * the freed page. So it all relies on 1.
>  	 */
> -	__free_page(page);
> +	arena_put_page(page);

[Severity: High]
Does this code call a sleepable function under a spinlock?

existing_page_cb() is passed as a callback to apply_to_existing_page_range()
during map destruction. The MM core function apply_to_pte_range() acquires
the Page Table Lock (PTL) spinlock via pte_offset_map_lock() before
iterating over PTEs and invoking the callback.

The new arena_put_page() function calls lock_page(), which contains a
might_sleep() check and waits on a bitlock that can sleep.

Sleeping while holding the PTL spinlock will lead to a 'scheduling while
atomic' panic or deadlock.

>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014233442.8392-1-emil@etsalapatis.com?part=2