Re: [PATCH bpf-next v2 2/3] bpf, arena: fix range_tree_set inconsistency on kmalloc_nolock failure

[bot+bpf-ci@kernel.org]

[-- Attachment #1: Type: text/plain, Size: 2203 bytes --]

> bpf, arena: fix range_tree_set inconsistency on kmalloc_nolock failure
>
> range_tree_set() pre-allocates the node needed for a brand-new range
> before calling range_tree_clear(), so an allocation failure returns
> -ENOMEM without having modified the tree (previously the overlapping
> nodes were already removed by range_tree_clear() before the allocation
> was attempted, permanently losing the cleared sub-ranges).
>
> Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>

Should this include a Fixes: tag?

The commit message describes a concrete bug: on allocation failure the
range tree was left with overlapping free sub-ranges already removed,
permanently losing that arena free space.

The clear-then-allocate ordering has been present since
kernel/bpf/range_tree.c was introduced. The original code had exactly
the same structure, only with bpf_mem_alloc() instead of
kmalloc_nolock():

    /* Clear out everything in the range we want to set. */
    err = range_tree_clear(rt, start, len);
    if (err)
        return err;
    ...
    } else {
        left = bpf_mem_alloc(&bpf_global_ma, sizeof(struct range_node));
        if (!left)
            return -ENOMEM;

Concrete reproduction of the pre-patch bug: with the tree holding a
single free range {[10,20]} and a call to range_tree_set(rt, 5, 20)
(i.e. start=5, last=24), range_tree_clear() takes the 'in the middle of
the clearing range' branch, removing and freeing [10,20]. The subsequent
allocation then fails, range_tree_set() returns -ENOMEM, and the tree is
left empty -- the [10,20] free range is gone for the lifetime of the
arena.

Four of the five callers (arena_alloc_pages() rollback at
kernel/bpf/arena.c:774, arena_free_pages() at :884, arena_free_worker()
at :1011, arena_vm_fault() rollback at :523/:529) discard
range_tree_set()'s return value, so the loss is silent.

Should this include:

  Fixes: b795379757eb ("bpf: Introduce range_tree data structure and use it in bpf arena")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31377360587