Re: [PATCH 5.15.y] bpf: avoid holding freeze_mutex during mmap operation

[Sasha Levin <sashal@kernel.org>]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: bc27c52eea189e8f7492d40739b7746d67b65beb

WARNING: Author mismatch between patch and upstream commit:
Backport author: David Sauerwein<dssauerw@amazon.de>
Commit author: Andrii Nakryiko<andrii@kernel.org>

Status in newer kernel trees:
6.14.y | Present (exact SHA1)
6.13.y | Present (different SHA1: 271e49f8a58e)
6.12.y | Present (different SHA1: d95607a5f2f9)
6.6.y | Present (different SHA1: 29cfda62ab4d)
6.1.y | Not found

Note: The patch differs from the upstream commit:
---
1:  bc27c52eea189 ! 1:  74c702cd74209 bpf: avoid holding freeze_mutex during mmap operation
    @@ Metadata
      ## Commit message ##
         bpf: avoid holding freeze_mutex during mmap operation
     
    +    [ Upstream commit bc27c52eea189e8f7492d40739b7746d67b65beb ]
    +
         We use map->freeze_mutex to prevent races between map_freeze() and
         memory mapping BPF map contents with writable permissions. The way we
         naively do this means we'll hold freeze_mutex for entire duration of all
    @@ Commit message
         Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
         Link: https://lore.kernel.org/r/20250129012246.1515826-2-andrii@kernel.org
         Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    +    Signed-off-by: Sasha Levin <sashal@kernel.org>
    +    Signed-off-by: David Sauerwein <dssauerw@amazon.de>
     
      ## kernel/bpf/syscall.c ##
     @@ kernel/bpf/syscall.c: static const struct vm_operations_struct bpf_map_default_vmops = {
    @@ kernel/bpf/syscall.c: static const struct vm_operations_struct bpf_map_default_v
     -	int err;
     +	int err = 0;
      
    - 	if (!map->ops->map_mmap || !IS_ERR_OR_NULL(map->record))
    - 		return -ENOTSUPP;
    + 	if (!map->ops->map_mmap || map_value_has_spin_lock(map) ||
    + 	    map_value_has_timer(map))
     @@ kernel/bpf/syscall.c: static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma)
      			err = -EACCES;
      			goto out;
    @@ kernel/bpf/syscall.c: static int bpf_map_mmap(struct file *filp, struct vm_area_
      	/* set default open/close callbacks */
      	vma->vm_ops = &bpf_map_default_vmops;
     @@ kernel/bpf/syscall.c: static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma)
    - 		vm_flags_clear(vma, VM_MAYWRITE);
    + 		vma->vm_flags &= ~VM_MAYWRITE;
      
      	err = map->ops->map_mmap(map, vma);
     -	if (err)
    @@ kernel/bpf/syscall.c: static int bpf_map_mmap(struct file *filp, struct vm_area_
     +			bpf_map_write_active_dec(map);
     +	}
      
    --	if (vma->vm_flags & VM_WRITE)
    +-	if (vma->vm_flags & VM_MAYWRITE)
     -		bpf_map_write_active_inc(map);
     -out:
     -	mutex_unlock(&map->freeze_mutex);
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.15.y       |  Success    |  Success   |