On Tue Sep 1, 2026 at 8:28 AM CEST, chenyuan_fl wrote: > From: Yuan Chen <[email protected]> > > v3 addresses Mykyta's review of v2 [3]. Both comments concern patch 1: > > 1. "Could you please double check if this is needed at all? I think > bpf_map_free_internal_structs() going to reset special fields to 0, > so immediate reuse by __bpf_async_init(), bpf_task_work_schedule() > correctly identifies fresh fields." > -> Correct: bpf_obj_cancel_fields() resets the timer/workqueue/ > task_work slots in place (xchg to NULL in bpf_async_cancel_and_free() > and bpf_task_work_cancel_and_free()), so no re-initialization is > needed on reuse. rhtab_init_map_value() is dropped entirely; the > element alloc path now matches htab's non-prealloc path > (alloc_htab_elem()), which also performs no explicit init. > > 2. "Let's directly call bpf_obj_cancel_fields() here and below, so it > is consistent with htab." > -> Done: the rhtab_cancel_fields() wrapper is removed and > rhtab_delete_elem()/rhtab_map_update_existing() call > bpf_obj_cancel_fields() directly. >
I split out two fixes from this, given Nuoqi's patch was already acked before, I decided to take that one with Mykyta's ack, and also rewrote commit log and simplified tests where possible. The remaining issue should be th BTF related problem, please send that separately, but also simplify it. The current fix is too convoluted. Just taking extra map BTF refcount for the dtor record should hopefully suffice. > The resizable hashtab still eagerly calls bpf_obj_free_fields() on > element delete/replace, which runs kptr destructors from the caller's > execution context (unsafe in NMI). This follows the existing discussion > on RHash special-field recycling (Nuoqi Gui's series [2] and the review > [1]): patch 1 applies the cancel semantics like hash/array maps > (a3a81d247651); patch 2 fixes a program-BTF use-after-free in the > mem-alloc destructor found while testing; patches 3-4 add regression > tests (NMI update, and per-field delete/re-insert cycles). > > Changes since v2 (all from Mykyta's review [3]): > > * Drop rhtab_init_map_value(): bpf_obj_cancel_fields() resets the > timer/workqueue/task_work slots to zero on delete, fresh elements > come zeroed from the bpf mem allocator, and kptr slots must stay > untouched, so no re-initialization is needed (matching htab's > non-prealloc path). > * Call bpf_obj_cancel_fields() directly instead of a rhtab-specific > wrapper, consistent with htab. > > [1] https://lore.kernel.org/bpf/[email protected]/ > [2] > https://lore.kernel.org/bpf/20260726-f01-23-rhash-cancel-bpf-next-v1-0-6e5e1131d...@mails.tsinghua.edu.cn/ > [3] > https://lore.kernel.org/bpf/[email protected]/ > > Yuan Chen (4): > bpf: Cancel special fields in resizable hashtab on recycle > bpf: Fix use-after-free of program BTF in mem-alloc destructor > selftests/bpf: Test rhtab kptr recycle from NMI context > selftests/bpf: Test rhtab special-field combinations > > kernel/bpf/hashtab.c | 98 +++++- > .../selftests/bpf/prog_tests/rhtab_fields.c | 337 ++++++++++++++++++ > .../testing/selftests/bpf/prog_tests/rhtab_kptr.c | 184 ++++++++++ > tools/testing/selftests/bpf/progs/rhtab_fields.c | 378 > +++++++++++++++++++++ > tools/testing/selftests/bpf/progs/rhtab_kptr.c | 146 ++++++++ > tools/testing/selftests/bpf/rhtab_fields_common.h | 19 ++ > tools/testing/selftests/bpf/rhtab_kptr_common.h | 6 + > 7 files changed, 1152 insertions(+), 16 deletions(-) > create mode 100644 tools/testing/selftests/bpf/prog_tests/rhtab_fields.c > create mode 100644 tools/testing/selftests/bpf/prog_tests/rhtab_kptr.c > create mode 100644 tools/testing/selftests/bpf/progs/rhtab_fields.c > create mode 100644 tools/testing/selftests/bpf/progs/rhtab_kptr.c > create mode 100644 tools/testing/selftests/bpf/rhtab_fields_common.h > create mode 100644 tools/testing/selftests/bpf/rhtab_kptr_common.h > > -- > 2.54.0
