Re: [PATCH mptcp-next v9 11/11] Squash to "selftests/bpf: Add bpf_burst scheduler & test"

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Reading a 64-bit atomic variable directly via READ_ONCE() from a BPF program causes load tearing on 32-bit architectures.
--

commit a7fdecf17f713344ff1f523b442eda6174e11cd2
Author: Geliang Tang <geliang@kernel.org>

    Squash to "selftests/bpf: Add bpf_burst scheduler & test"

This commit modifies the BPF burst scheduler test to safely read the newly
converted atomic64_t field msk->snd_nxt using READ_ONCE() on its .counter
member within the BPF context.

> diff --git a/tools/testing/selftests/bpf/progs/mptcp_bpf_burst.c b/tools/testing/selftests/bpf/progs/mptcp_bpf_burst.c
> index 3d512b0efe6f7..a391f6563a618 100644
> --- a/tools/testing/selftests/bpf/progs/mptcp_bpf_burst.c
> +++ b/tools/testing/selftests/bpf/progs/mptcp_bpf_burst.c
> @@ -108,7 +108,8 @@ int BPF_PROG(bpf_burst_get_send, struct mptcp_sock *msk)
>  	if (!subflow || !bpf_sk_stream_memory_free(subflow))
>  		return -1;
>  
> -	burst = min(MPTCP_SEND_BURST_SIZE, mptcp_wnd_end(msk) - msk->snd_nxt);
> +	burst = min(MPTCP_SEND_BURST_SIZE,
> +		    mptcp_wnd_end(msk) - READ_ONCE(msk->snd_nxt.counter));

[Severity: Medium]
Will this cause load tearing on 32-bit architectures?

When the kernel concurrently updates msk->snd_nxt using atomic64_set(), on
32-bit architectures (e.g. ARM32, i386) configured with CONFIG_GENERIC_ATOMIC64,
atomic64_t operations are protected by hashed spinlocks. The BPF JIT will
translate the 64-bit load of READ_ONCE(msk->snd_nxt.counter) into two separate,
unsynchronized 32-bit memory loads.

If the BPF program executes these memory loads while the kernel is writing to
the counter, it could observe a torn read, leading to an incorrect burst size
calculation that breaks the MPTCP bpf_burst scheduler logic.

>  	ssk = mptcp_subflow_tcp_sock(subflow);
>  	wmem = ssk->sk_wmem_queued;
>  	if (!burst)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1787827525.git.tanggeliang@kylinos.cn?part=11