Re: [PATCH bpf] bpf: Fix soft lockup in fd_array_map_free()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] bpf: signed integer overflow in map iterators [1]
--

commit be46454b32f6f3b215fec94602410fee2a07b5c7
Author: Li Jinyue <jinyue.li@linux.alibaba.com>

bpf: Fix soft lockup in fd_array_map_free()

This commit adds a cond_resched() call to the entry check loop in
fd_array_map_free() to avoid soft lockups when freeing maps with a large
number of entries.

> diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
> index 133f189bf6d27..b975ec3c39e57 100644
> --- a/kernel/bpf/arraymap.c
> +++ b/kernel/bpf/arraymap.c
> @@ -924,8 +924,10 @@ static void fd_array_map_free(struct bpf_map *map)
>  	int i;
>  
>  	/* make sure it's empty */
> -	for (i = 0; i < array->map.max_entries; i++)
> +	for (i = 0; i < array->map.max_entries; i++) {
>  		BUG_ON(array->ptrs[i] != NULL);
> +		cond_resched();
> +	}

[Severity: Critical]
This problem wasn't introduced by this patch, but can i overflow here when
array->map.max_entries exceeds INT_MAX [1]?

Because i is a signed int compared against the unsigned u32 max_entries, a
map created with max_entries > INT_MAX (when bpf_bypass_spec_v1 is
permitted) causes i to wrap to INT_MIN after reaching INT_MAX.  The
unsigned comparison then stays true and array->ptrs[i] indexes memory at a
large negative offset.  The same signed loop counter issue also affects
bpf_array_alloc_percpu(), bpf_array_free_percpu(), and
perf_event_fd_array_release() in this file, where indexing with a negative
i corrupts or reads out-of-bounds memory.  Should i be declared as u32?

[1] https://sashiko.dev/#/bug/linux-4e93eb71-24a1-4040-b74f-c1c6d5ae58c8

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112122015.3356106-1-jinyue.li@linux.alibaba.com?part=1