Messages in this thread |  | | Subject | Re: [PATCH bpf v1] bpf: Avoid faultable build ID reads under mm locks | | From | bot+bpf-ci@kernel ... | | Date | Wed, 8 Apr 2026 01:05:20 +0000 (UTC) |
| |
> diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c > index da3d328f5c15..017ecbc22c96 100644 > --- a/kernel/bpf/stackmap.c > +++ b/kernel/bpf/stackmap.c
[ ... ]
> +static void stack_map_get_build_id_offset_sleepable(struct bpf_stack_build_id *id_offs, > + u32 trace_nr) > +{ > + struct mm_struct *mm = current->mm; > + struct vm_area_struct *vma; > + struct file *file; > + u64 ip; > + > + for (u32 i = 0; i < trace_nr; i++) { > + ip = READ_ONCE(id_offs[i].ip); > + vma = stack_map_lock_vma(mm, ip); > + if (!range_in_vma(vma, ip, ip) || !vma->vm_file) { > + stack_map_build_id_set_ip(&id_offs[i]); > + if (vma) > + vma_end_read(vma); > + continue; > + } > + > + file = get_file(vma->vm_file); > + vma_end_read(vma); > + > + /* build_id_parse_file() may block on filesystem reads */ > + if (build_id_parse_file(file, id_offs[i].build_id, NULL)) { > + stack_map_build_id_set_ip(&id_offs[i]); > + } else { > + id_offs[i].offset = (vma->vm_pgoff << PAGE_SHIFT) + ip - vma->vm_start; > + id_offs[i].status = BPF_STACK_BUILD_ID_VALID; > + }
After vma_end_read(vma) drops the per-VMA read lock, can vma->vm_pgoff and vma->vm_start still be safely accessed here? It looks like the VMA could be split, merged, or freed by another thread while build_id_parse_file() blocks on filesystem I/O.
The non-sleepable path in stack_map_get_build_id_offset() reads these same fields under mmap_read_lock, which keeps the VMA stable. Here the lock is already gone.
Saving vm_pgoff and vm_start to local variables before vma_end_read() would close the window, similar to the approach in the procfs patch referenced in the commit message.
> + > + fput(file); > + } > +}
--- AI reviewed your patch. Please fix the bug or email reply why it's not a bug. See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24111574515 |  |