From: Yuan Chen <[email protected]> Posted in reply to Kumar Kartikeya Dwivedi's review [1] of Nuoqi Gui's overlapping series [2]: switching rhtab to bpf_obj_cancel_fields() alone leaks referenced kptrs, because rhtab_map_update_elem() zeroes the kptr slot of a recycled element via check_and_init_map_value() before the allocator destructor can release it.
The resizable hashtab still eagerly calls bpf_obj_free_fields() on element delete/replace, which runs kptr destructors from the caller's execution context (unsafe in NMI). Patch 1 applies the cancel semantics like hash/array maps (a3a81d247651) and fixes the recycle-path kptr leak with rhtab_init_map_value(); patch 2 fixes a program-BTF use-after-free in the mem-alloc destructor found while testing; patches 3-4 add regression tests (NMI update, and per-field delete/re-insert cycles). Verified in QEMU (KASAN, current bpf-next): rhtab_kptr, rhtab_fields (4/4) and rhash pass with the fix; on the unfixed kernel the kptr subtests fail at the recycle assertions and the program-BTF UAF reproduces. Changes since v1: fix the recycle-path kptr leak, extend the selftests with delete/re-insert recycle coverage, add per-field combination tests, fix the program-BTF UAF (patch 2). [1] https://lore.kernel.org/bpf/[email protected]/ [2] https://lore.kernel.org/bpf/20260726-f01-23-rhash-cancel-bpf-next-v1-0-6e5e1131d...@mails.tsinghua.edu.cn/ Yuan Chen (4): bpf: Cancel special fields in resizable hashtab on recycle bpf: Fix use-after-free of program BTF in mem-alloc destructor selftests/bpf: Test rhtab kptr recycle from NMI context selftests/bpf: Test rhtab special-field combinations kernel/bpf/hashtab.c | 115 ++++++- .../selftests/bpf/prog_tests/rhtab_fields.c | 213 ++++++++++++ .../selftests/bpf/prog_tests/rhtab_kptr.c | 146 +++++++++ .../selftests/bpf/progs/rhtab_fields.c | 305 ++++++++++++++++++ .../testing/selftests/bpf/progs/rhtab_kptr.c | 132 ++++++++ 5 files changed, 901 insertions(+), 10 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/rhtab_fields.c create mode 100644 tools/testing/selftests/bpf/prog_tests/rhtab_kptr.c create mode 100644 tools/testing/selftests/bpf/progs/rhtab_fields.c create mode 100644 tools/testing/selftests/bpf/progs/rhtab_kptr.c -- 2.54.0
