Re: [PATCH bpf-next 2/3] bpf: arena: allocate the fault-in page outside the lock

--===============2056660838945013230==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

> bpf: arena: allocate the fault-in page outside the lock
>
> arena_vm_fault() allocated the page while holding arena->spinlock, so it
> could only use the non-blocking allocator. Once the memcg is at
> memory.max that allocation just fails, the fault turns into
> VM_FAULT_SIGSEGV, and the process gets a SIGSEGV on a perfectly valid
> arena address. Hitting memory.max is routine (e.g. page cache from
> reading a big file), so this kills innocent processes.
>
> Preallocate the page before taking the lock, like do_anonymous_page()
> does, so the allocation can sleep and go through reclaim and the OOM
> path, and return VM_FAULT_OOM on failure so the memcg OOM handler runs
> instead of a fake segfault. Also tidy up the error labels.
>
> Signed-off-by: Jiayuan Chen <[email protected]>

This looks like a fix for a real bug that could send a SIGSEGV to a
process on a valid arena address once the memcg hits memory.max.

The allocation was moved under arena->spinlock, and the error path
switched to VM_FAULT_SIGSEGV, when arena_vm_fault() replaced its
guard(mutex)(&arena->lock) with raw_res_spin_lock_irqsave(&arena->spinlock,
flags). Should this carry a Fixes: tag pointing at that change?

  Fixes: b8467290edab ("bpf: arena: make arena kfuncs any context safe")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/30243398938
--===============2056660838945013230==--