Re: [PATCH bpf] bpf: Hash lock addresses in rqspinlock violation reports

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Tue Sep 1, 2026 at 4:47 AM PDT, Aohan Mei wrote:
> From: Aohan Mei <henrymei@tencent.com>
>
> bpf_prog_report_rqspinlock_violation() prints the attempted lock and
> every held lock with %px, which expands to the raw pointer value.
> The report lands in the program's BPF_STDERR stream, and that stream
> is readable through BPF_PROG_STREAM_READ_BY_FD with no privilege
> check on the read side: prog_stream_read() only validates the fd
> with bpf_prog_get().
>
> Any user with read access to the program fd (a shared fd, a BPF
> token delegation, or an unprivileged child) can therefore read back
> the raw kernel addresses of the rqspinlock objects, which are
> dynamic allocations whose placement depends on KASLR and the slab
> layout.  The verifier-facing log path gates pointer printing on
> allow_ptr_leaks; the stream path has no equivalent gate.
>
> Print the ptr_to_hashval() hash of each address instead, so the
> report still allows correlating the attempted lock with the held
> locks within a boot, without exposing the raw addresses.  Fall back
> to printing 0 if hashing fails.
>
> Fixes: ecec5b5743bf ("bpf: Report rqspinlock deadlocks/timeout to BPF stderr")
> Reported-by: TencentOS Corvus AI <corvus@tencent.com>
> Cc: stable@vger.kernel.org
> Assisted-by: CodeBuddy:Kimi-K3
> Signed-off-by: Aohan Mei <henrymei@tencent.com>
> ---
>  kernel/bpf/rqspinlock.c | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/kernel/bpf/rqspinlock.c b/kernel/bpf/rqspinlock.c
> index 111ec80ea958..5721dc1a9577 100644
> --- a/kernel/bpf/rqspinlock.c
> +++ b/kernel/bpf/rqspinlock.c
> @@ -16,6 +16,7 @@
>  #include <linux/smp.h>
>  #include <linux/bug.h>
>  #include <linux/bpf.h>
> +#include <linux/string.h>
>  #include <linux/err.h>
>  #include <linux/cpumask.h>
>  #include <linux/percpu.h>
> @@ -673,6 +674,7 @@ __bpf_kfunc_start_defs();
>  static void bpf_prog_report_rqspinlock_violation(const char *str, void *lock, bool irqsave)
>  {
>  	struct rqspinlock_held *rqh = this_cpu_ptr(&rqspinlock_held_locks);
> +	unsigned long hashval;
>  	struct bpf_stream_stage ss;
>  	struct bpf_prog *prog;
>  
> @@ -681,10 +683,15 @@ static void bpf_prog_report_rqspinlock_violation(const char *str, void *lock, bo
>  		return;
>  	bpf_stream_stage(ss, prog, BPF_STDERR, ({
>  		bpf_stream_printk(ss, "ERROR: %s for bpf_res_spin_lock%s\n", str, irqsave ? "_irqsave" : "");
> -		bpf_stream_printk(ss, "Attempted lock   = 0x%px\n", lock);
> +		if (ptr_to_hashval(lock, &hashval))
> +			hashval = 0;
> +		bpf_stream_printk(ss, "Attempted lock   = 0x%08lx\n", hashval);

No. This is not necessary.

pw-bot: cr