[PATCH bpf-next 0/2] bpf: Cancel special fields in resizable hashtab on recycle

From: Yuan Chen <[email protected]>

The resizable hashtab (BPF_MAP_TYPE_RHASH) still eagerly calls
bpf_obj_free_fields() when an element is deleted or its value is
replaced, which runs kptr destructors in the caller's execution context.
This is unsafe for BPF programs running in NMI context (e.g. perf_event
programs attached to hardware PMU overflows), where referenced kptr
destructors may take locks or otherwise cannot run.

Commit a3a81d247651 ("bpf: Cancel special fields on map value recycle")
switched the hash map and array recycle paths to bpf_obj_cancel_fields(),
which only cancels NMI-safe fields (timer, workqueue, task_work), but it
missed the resizable hashtab. Patch 1 applies the same semantics to
rhtab; patch 2 adds a regression test.

Yuan Chen (2):
  bpf: Cancel special fields in resizable hashtab on recycle
  selftests/bpf: Test rhtab kptr recycle from NMI context

 kernel/bpf/hashtab.c                          |  28 +++--
 .../selftests/bpf/prog_tests/rhtab_kptr.c     |  87 +++++++++++++++
 .../testing/selftests/bpf/progs/rhtab_kptr.c  | 101 ++++++++++++++++++
 3 files changed, 207 insertions(+), 9 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/rhtab_kptr.c
 create mode 100644 tools/testing/selftests/bpf/progs/rhtab_kptr.c

-- 
2.54.0