Re: [PATCH v3 bpf-next 12/13] bpf: Introduce bpf_mem_free_rcu() similar to kfree_rcu().

[Alexei Starovoitov <alexei.starovoitov@xxxxxxxxx>]

On Wed, Jun 28, 2023 at 7:24 PM Hou Tao <houtao@xxxxxxxxxxxxxxx> wrote:
>
> I think the race could be fixed by checking c->draining in
> do_call_rcu_ttrace() when atomic_xchg() returns 1 as shown below:
>
> diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c
> index 2bdb894392c5..9f41025560bd 100644
> --- a/kernel/bpf/memalloc.c
> +++ b/kernel/bpf/memalloc.c
> @@ -303,8 +303,13 @@ static void do_call_rcu_ttrace(struct bpf_mem_cache *c)
>  {
>         struct llist_node *llnode, *t;
>
> -       if (atomic_xchg(&c->call_rcu_ttrace_in_progress, 1))
> +       if (atomic_xchg(&c->call_rcu_ttrace_in_progress, 1)) {
> +               if (READ_ONCE(c->draining)) {
> +                       llnode = llist_del_all(&c->free_by_rcu_ttrace);
> +                       free_all(llnode, !!c->percpu_size);
> +               }
>                 return;
> +       }

I managed to repro with your extra check-leaks patch that I will
include in the series.
The fix also makes sense.
Thanks