Re: [PATCH bpf-next] bpf: Annotate data races on bpf_lru_node type

[Alexei Starovoitov]

On Tue, Oct 13, 2026 at 11:00 PM Nicholas Velten via B4 Relay <devnull+nicholasfvelten.gmail.com@xxxxxxxxxx> wrote:
> Both races are benign: the type is a single byte, the sanity check only

[...]

> Fixes: 3a08c2fd7634 ("bpf: LRU List")

It's not a fix. There is nothing to backport. Drop the tag.

> @@ -298,7 +298,7 @@ static void bpf_lru_list_push_free(struct bpf_lru_list *l,
>  {
>  	unsigned long flags;
>
> -	if (WARN_ON_ONCE(IS_LOCAL_LIST_TYPE(node->type)))
> +	if (WARN_ON_ONCE(IS_LOCAL_LIST_TYPE(READ_ONCE(node->type))))
>  		return;

__bpf_lru_node_move() called few lines below does the same
WARN_ON_ONCE(IS_LOCAL_LIST_TYPE(node->type)) under l->lock.
Remove this check instead of annotating it.

> @@ -357,7 +357,7 @@ static void __local_list_add_pending(struct bpf_lru *lru,
>  {
>  	*(u32 *)((void *)node + lru->hash_offset) = hash;
>  	node->cpu = cpu;
> -	node->type = BPF_LRU_LOCAL_LIST_T_PENDING;
> +	WRITE_ONCE(node->type, BPF_LRU_LOCAL_LIST_T_PENDING);

The node in push_free is not in the htab anymore, so del_from_htab()
fails and shrink or steal cannot take it.
Only flush and rotate can change its type, which is
__bpf_lru_node_move_in() and __bpf_lru_node_move().
Here and in the other three places the node has one owner and
nobody is reading its type. No need for WRITE_ONCE.

pw-bot: cr