Re: [PATCH bpf-next v6 3/3] bpf, arena: check range_tree_set return in arena_free_pages and arena_free_worker

[Alexei Starovoitov]

On Tue, Sep 22, 2026 at 03:21 PM chenyuan_fl@xxxxxxx <chenyuan_fl@xxxxxxx> wrote:
> range_tree_set() can fail with -ENOMEM, but the arena callers ignored its
> return value. In arena_free_worker() it ran after PTE clearing, so a
> failed update left the range marked allocated while its pages were
> already unmapped and freed.

That's not a bug. The range is allocated in the range tree and has
no pages. bpf_arena_reserve_pages() creates the same state.
Nothing relies on an allocated range having pages.
The cost is page_cnt pages of address space.

[...]
> +	ret = range_tree_set(&arena->rt, pgoff, page_cnt);
> +	if (ret) {
> +		/*
> +		 * range_tree_set() is failure-atomic: on -ENOMEM the range
> +		 * stays allocated and its pages mapped. Abort the free
> +		 * instead of unmapping pages the tree does not track; the
> +		 * program can free the range again later.
> +		 */
> +		raw_res_spin_unlock_irqrestore(&arena->spinlock, flags);
> +		bpf_map_memcg_exit(old_memcg, new_memcg);
> +		return;
> +	}

No. This makes it worse.
range_tree_set() fails when the system is out of memory. Today the
pages are still unmapped and freed and only the address range is lost.
With this patch the pages stay mapped until map free, so the prog
leaks memory instead of address space.
bpf_arena_free_pages() returns void. The prog cannot know that it
has to free the range again.
arena_alloc_pages() calls arena_free_pages() to undo a partial
allocation. Now it can return NULL and keep those pages mapped.
Same for arena_free_worker().

Drop this patch. Pls respin 1 and 2 only.
No need for a separate series for arena_vm_fault() either.

pw-bot: cr