From: Yuan Chen <[email protected]>
v3 addresses Mykyta's review of v2 [3]. Both comments concern patch 1:
1. "Could you please double check if this is needed at all? I think
bpf_map_free_internal_structs() going to reset special fields to 0,
so immediate reuse by __bpf_async_init(), bpf_task_work_schedule()
correctly identifies fresh fields."
-> Correct: bpf_obj_cancel_fields() resets the timer/workqueue/
task_work slots in place (xchg to NULL in bpf_async_cancel_and_free()
and bpf_task_work_cancel_and_free()), so no re-initialization is
needed on reuse. rhtab_init_map_value() is dropped entirely; the
element alloc path now matches htab's non-prealloc path
(alloc_htab_elem()), which also performs no explicit init.
2. "Let's directly call bpf_obj_cancel_fields() here and below, so it
is consistent with htab."
-> Done: the rhtab_cancel_fields() wrapper is removed and
rhtab_delete_elem()/rhtab_map_update_existing() call
bpf_obj_cancel_fields() directly.
The resizable hashtab still eagerly calls bpf_obj_free_fields() on
element delete/replace, which runs kptr destructors from the caller's
execution context (unsafe in NMI). This follows the existing discussion
on RHash special-field recycling (Nuoqi Gui's series [2] and the review
[1]): patch 1 applies the cancel semantics like hash/array maps
(a3a81d247651); patch 2 fixes a program-BTF use-after-free in the
mem-alloc destructor found while testing; patches 3-4 add regression
tests (NMI update, and per-field delete/re-insert cycles).
Changes since v2 (all from Mykyta's review [3]):
* Drop rhtab_init_map_value(): bpf_obj_cancel_fields() resets the
timer/workqueue/task_work slots to zero on delete, fresh elements
come zeroed from the bpf mem allocator, and kptr slots must stay
untouched, so no re-initialization is needed (matching htab's
non-prealloc path).
* Call bpf_obj_cancel_fields() directly instead of a rhtab-specific
wrapper, consistent with htab.
[1] https://lore.kernel.org/bpf/[email protected]/
[2]
https://lore.kernel.org/bpf/20260726-f01-23-rhash-cancel-bpf-next-v1-0-6e5e1131d...@mails.tsinghua.edu.cn/
[3] https://lore.kernel.org/bpf/[email protected]/
Yuan Chen (4):
bpf: Cancel special fields in resizable hashtab on recycle
bpf: Fix use-after-free of program BTF in mem-alloc destructor
selftests/bpf: Test rhtab kptr recycle from NMI context
selftests/bpf: Test rhtab special-field combinations
kernel/bpf/hashtab.c | 98 +++++-
.../selftests/bpf/prog_tests/rhtab_fields.c | 337 ++++++++++++++++++
.../testing/selftests/bpf/prog_tests/rhtab_kptr.c | 184 ++++++++++
tools/testing/selftests/bpf/progs/rhtab_fields.c | 378 +++++++++++++++++++++
tools/testing/selftests/bpf/progs/rhtab_kptr.c | 146 ++++++++
tools/testing/selftests/bpf/rhtab_fields_common.h | 19 ++
tools/testing/selftests/bpf/rhtab_kptr_common.h | 6 +
7 files changed, 1152 insertions(+), 16 deletions(-)
create mode 100644 tools/testing/selftests/bpf/prog_tests/rhtab_fields.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/rhtab_kptr.c
create mode 100644 tools/testing/selftests/bpf/progs/rhtab_fields.c
create mode 100644 tools/testing/selftests/bpf/progs/rhtab_kptr.c
create mode 100644 tools/testing/selftests/bpf/rhtab_fields_common.h
create mode 100644 tools/testing/selftests/bpf/rhtab_kptr_common.h
--
2.54.0
