netdev - Re: [RFC PATCH bpf-next v2 06/12] bpf: Change local

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAADnVQ+X1Otu+hrBeCq6Zr9vAaH5vGU42s6jLdBiDiLQcwpj4Q@mail.gmail.com>
Date: Thu, 2 Oct 2025 16:37:30 -0700
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Amery Hung <ameryhung@...il.com>
Cc: bpf <bpf@...r.kernel.org>, Network Development <netdev@...r.kernel.org>, 
	Andrii Nakryiko <andrii@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, 
	Kumar Kartikeya Dwivedi <memxor@...il.com>, Martin KaFai Lau <martin.lau@...nel.org>, KP Singh <kpsingh@...nel.org>, 
	Yonghong Song <yonghong.song@...ux.dev>, Song Liu <song@...nel.org>, Hao Luo <haoluo@...gle.com>, 
	Kernel Team <kernel-team@...a.com>
Subject: Re: [RFC PATCH bpf-next v2 06/12] bpf: Change local_storage->lock and
 b->lock to rqspinlock

On Thu, Oct 2, 2025 at 3:54 PM Amery Hung <ameryhung@...il.com> wrote:
>
>         bpf_selem_free_list(&old_selem_free_list, false);
>         if (alloc_selem) {
>                 mem_uncharge(smap, owner, smap->elem_size);
> @@ -791,7 +812,7 @@ void bpf_local_storage_destroy(struct bpf_local_storage *local_storage)
>          * when unlinking elem from the local_storage->list and
>          * the map's bucket->list.
>          */
> -       raw_spin_lock_irqsave(&local_storage->lock, flags);
> +       while (raw_res_spin_lock_irqsave(&local_storage->lock, flags));

This pattern and other while(foo) doesn't make sense to me.
res_spin_lock will fail only on deadlock or timeout.
We should not spin, since retry will likely produce the same
result. So the above pattern just enters into infinite spin.

If it should never fail in practice then pr_warn_once and goto out
leaking memory. Better yet defer to irq_work and cleanup there.