This series fixes an issue where accessing a valid BPF arena page under
memory pressure (hitting a cgroup's memory.max limit) incorrectly results
in a SIGSEGV crash instead of invoking memory reclaim or the memcg OOM
killer.
Problem:
========
arena_vm_fault() performed page allocation while holding arena->spinlock
(with interrupts disabled), restricting the allocation to the non-blocking
alloc_pages_nolock() path, which cannot sleep, reclaim memory, or invoke
the memcg OOM killer. When the cgroup's memory.max limit was reached, the
allocation returned -ENOMEM, which arena_vm_fault() converted to
VM_FAULT_SIGSEGV, killing the process on a valid virtual address. Hitting
memory.max is routine (e.g., page cache growth from reading a large file),
so this killed innocent processes.
Solution:
=========
1. Add bpf_map_alloc_page_sleepable() for callers that know they are in a
sleepable context. can_alloc_pages() is a conservative guess for BPF
program context -- notably it is always false on PREEMPT_RT -- so going
through bpf_map_alloc_pages() there needlessly picks the non-blocking
allocator. The new helper uses BPF_PAGE_GFP (GFP_KERNEL | __GFP_ZERO |
__GFP_ACCOUNT | __GFP_NOWARN) directly.
2. Rework arena_vm_fault() to preallocate the page outside arena->spinlock
with bpf_map_alloc_page_sleepable(), like do_anonymous_page() does, so
it can sleep, reclaim, and invoke the memcg OOM killer instead of
turning a routine memory.max event into a spurious SIGSEGV.
3. A lockless probe (vmalloc_to_page()) before allocation skips
preallocation when a page is already mapped (e.g., allocated by the bpf
program), so the common case wastes no allocation. The rare race where
such a page is freed before the lock is taken falls back to the
non-blocking allocator under the lock.
4. Return VM_FAULT_SIGBUS for non-recoverable errors (lock failure,
range-tree and page-table failures) instead of VM_FAULT_SIGSEGV;
only BPF_F_SEGV_ON_FAULT, and a scratch-page hole under that flag,
is a real user addressing error and keeps VM_FAULT_SIGSEGV.
5. Add a BPF selftest (arena_memcg) that joins a child process into a
memcg capped 64 MiB above its post-load usage, faults arena pages
until the budget is exhausted, and verifies the child is OOM-killed
(memcg oom_kill event) rather than receiving SIGSEGV.
v6 vs v5:
- Fixed redundant #include <unistd.h> inside #ifndef PAGE_SIZE guard
in the selftest (the header was already unconditionally included).
- All patches carry both original author and reviewer Signed-off-by.
Signed-off-by: Khawar Ahemad <ahemadkhawar123@gmail.com>
Jiayuan Chen (4):
bpf: Add a sleepable page allocator for map memory
bpf: arena: allocate the fault-in page outside the lock
selftests/bpf: Add read_cgroup_file() to cgroup_helpers
selftests/bpf: Add a test for arena fault-in under memory.max
include/linux/bpf.h | 1 +
kernel/bpf/arena.c | 90 +++++++---
kernel/bpf/syscall.c | 21 ++-
tools/testing/selftests/bpf/cgroup_helpers.c | 67 ++++++++
tools/testing/selftests/bpf/cgroup_helpers.h | 4 +
.../selftests/bpf/prog_tests/arena_memcg.c | 157 ++++++++++++++++++
.../testing/selftests/bpf/progs/arena_memcg.c | 24 +++
7 files changed, 339 insertions(+), 25 deletions(-)
create mode 100644 tools/testing/selftests/bpf/prog_tests/arena_memcg.c
create mode 100644 tools/testing/selftests/bpf/progs/arena_memcg.c
--
2.54.0 (Apple Git-157)