[PATCH bpf-next v6 0/4] bpf: arena: handle memory.max on fault-in with reclaim/OOM

[Khawar Ahemad]

This series fixes an issue where accessing a valid BPF arena page under
memory pressure (hitting a cgroup's memory.max limit) incorrectly results
in a SIGSEGV crash instead of invoking memory reclaim or the memcg OOM
killer.

Problem:
========
arena_vm_fault() performed page allocation while holding arena->spinlock
(with interrupts disabled), restricting the allocation to the non-blocking
alloc_pages_nolock() path, which cannot sleep, reclaim memory, or invoke
the memcg OOM killer. When the cgroup's memory.max limit was reached, the
allocation returned -ENOMEM, which arena_vm_fault() converted to
VM_FAULT_SIGSEGV, killing the process on a valid virtual address. Hitting
memory.max is routine (e.g., page cache growth from reading a large file),
so this killed innocent processes.

Solution:
=========
1. Add bpf_map_alloc_page_sleepable() for callers that know they are in a
   sleepable context. can_alloc_pages() is a conservative guess for BPF
   program context -- notably it is always false on PREEMPT_RT -- so going
   through bpf_map_alloc_pages() there needlessly picks the non-blocking
   allocator. The new helper uses BPF_PAGE_GFP (GFP_KERNEL | __GFP_ZERO |
   __GFP_ACCOUNT | __GFP_NOWARN) directly.

2. Rework arena_vm_fault() to preallocate the page outside arena->spinlock
   with bpf_map_alloc_page_sleepable(), like do_anonymous_page() does, so
   it can sleep, reclaim, and invoke the memcg OOM killer instead of
   turning a routine memory.max event into a spurious SIGSEGV.

3. A lockless probe (vmalloc_to_page()) before allocation skips
   preallocation when a page is already mapped (e.g., allocated by the bpf
   program), so the common case wastes no allocation. The rare race where
   such a page is freed before the lock is taken falls back to the
   non-blocking allocator under the lock.

4. Return VM_FAULT_SIGBUS for non-recoverable errors (lock failure,
   range-tree and page-table failures) instead of VM_FAULT_SIGSEGV;
   only BPF_F_SEGV_ON_FAULT, and a scratch-page hole under that flag,
   is a real user addressing error and keeps VM_FAULT_SIGSEGV.

5. Add a BPF selftest (arena_memcg) that joins a child process into a
   memcg capped 64 MiB above its post-load usage, faults arena pages
   until the budget is exhausted, and verifies the child is OOM-killed
   (memcg oom_kill event) rather than receiving SIGSEGV.

v6 vs v5:
  - Fixed redundant #include <unistd.h> inside #ifndef PAGE_SIZE guard
    in the selftest (the header was already unconditionally included).
  - All patches carry both original author and reviewer Signed-off-by.

Signed-off-by: Khawar Ahemad <ahemadkhawar123@xxxxxxxxx>

Jiayuan Chen (4):
  bpf: Add a sleepable page allocator for map memory
  bpf: arena: allocate the fault-in page outside the lock
  selftests/bpf: Add read_cgroup_file() to cgroup_helpers
  selftests/bpf: Add a test for arena fault-in under memory.max

 include/linux/bpf.h                           |   1 +
 kernel/bpf/arena.c                            |  90 +++++++---
 kernel/bpf/syscall.c                          |  21 ++-
 tools/testing/selftests/bpf/cgroup_helpers.c  |  67 ++++++++
 tools/testing/selftests/bpf/cgroup_helpers.h  |   4 +
 .../selftests/bpf/prog_tests/arena_memcg.c    | 157 ++++++++++++++++++
 .../testing/selftests/bpf/progs/arena_memcg.c |  24 +++
 7 files changed, 339 insertions(+), 25 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/arena_memcg.c
 create mode 100644 tools/testing/selftests/bpf/progs/arena_memcg.c

-- 
2.54.0 (Apple Git-157)