Re: [PATCH] bpf: arena: Flush stale TLB entries before reusing ranges

[Alexei Starovoitov]

On Sun, Sep 20, 2026 at 12:46 AM Andrea Righi <arighi@xxxxxxxxxx> wrote:
> @@ -911,11 +910,17 @@ static void arena_free_pages(struct bpf_arena *arena, long uaddr, long page_cnt,
>  			zap_pages(arena, full_uaddr, 1);
>  		__free_page(page);
>  	}
> +
> +	ret = raw_res_spin_lock_irqsave(&arena->spinlock, flags);
> +	if (ret)
> +		goto defer_publish;
> +	range_tree_set(&arena->rt, pgoff, page_cnt);
> +	raw_res_spin_unlock_irqrestore(&arena->spinlock, flags);

Now the ptes are cleared in one locked section and the range is set in
another, and arena_vm_fault() can get in between. It doesn't look at
the range tree to decide. It does vmalloc_to_page(), sees no page,
range_tree_clear() of an already clear range returns 0, so it allocates
a page and installs it into the kernel pte. Then the code above marks
that range free. The next bpf_arena_alloc_pages() that picks it hits
  WARN_ON_ONCE(pte_page(old) != d->arena->scratch_page)
in apply_range_set_cb(), returns NULL, puts t
he range back into the
tree, and the next call does the same. All it takes is user space
touching the page while the prog frees it.

iirc Emil has patches that address this issue differently.

pw-bot: cr