From 70746935788c8284a20c5aa360603855ac24e562 Mon Sep 17 00:00:00 2001 From: Alan Maguire Date: Wed, 5 Feb 2025 17:00:59 +0000 Subject: [PATCH] bpf/arena: fix softlockup in arena_map_free on 64k page kernel On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y (64k pages), arena_htab tests cause a segmentation fault and soft lockup. $ sudo ./test_progs -t arena_htab Caught signal #11! Stack trace: ./test_progs(crash_handler+0x1c)[0x7bd4d8] linux-vdso.so.1(__kernel_rt_sigreturn+0x0)[0xffffb34a0968] ./test_progs[0x420f74] ./test_progs(htab_lookup_elem+0x3c)[0x421090] ./test_progs[0x421320] ./test_progs[0x421bb8] ./test_progs(test_arena_htab+0x40)[0x421c14] ./test_progs[0x7bda84] ./test_progs(main+0x65c)[0x7bf670] /usr/lib64/libc.so.6(+0x2caa0)[0xffffb31ecaa0] /usr/lib64/libc.so.6(__libc_start_main+0x98)[0xffffb31ecb78] ./test_progs(_start+0x30)[0x41b4f0] Message from syslogd@bpfol9aarch64 at Feb 4 08:50:09 ... kernel:watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/u8:4:7589] The same failure is not observed with 4k pages on aarch64. Investigating further, it turns out arena_map_free() was calling apply_to_existing_page_range() with the address returned by bpf_arena_get_kern_vm_start(). If this address is not page-aligned - as is the case for a 64k page kernel - we wind up calling apply_to_pte_range() with that unaligned address. The problem is apply_to_pte_range() implicitly assumes that the addr passed in is page-aligned, specifically in this loop: do { if (create || !pte_none(ptep_get(pte))) { err = fn(pte++, addr, data); if (err) break; } } while (addr += PAGE_SIZE, addr != end); If addr is _not_ page-aligned, it will never equal end exactly. One solution is to round up GUARD_SZ to PAGE_SIZE << 1 so that the division by 2 in bpf_arena_get_kern_vm_start() returns a page-aligned value. With that change in place, the test passes: $ sudo ./test_progs -t arena_htab Summary: 1/1 PASSED, 1 SKIPPED, 0 FAILED Fixes: 317460317a02 ("bpf: Introduce bpf_arena.") Reported-by: Colm Harrington Suggested-by: Alexei Starovoitov Signed-off-by: Alan Maguire --- kernel/bpf/arena.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c index 870aeb51d70ad..095a9554e1def 100644 --- a/kernel/bpf/arena.c +++ b/kernel/bpf/arena.c @@ -39,7 +39,7 @@ */ /* number of bytes addressable by LDX/STX insn with 16-bit 'off' field */ -#define GUARD_SZ (1ull << sizeof_field(struct bpf_insn, off) * 8) +#define GUARD_SZ round_up(1ull << sizeof_field(struct bpf_insn, off) * 8, PAGE_SIZE << 1) #define KERN_VM_SZ (SZ_4G + GUARD_SZ) struct bpf_arena {