On 4/9/25 8:28 AM, Brandon Kammerdiener wrote:
This patch fixes an endless loop condition that can occur in
bpf_for_each_hash_elem, causing the core to softlock. My understanding is
that a combination of RCU list deletion and insertion introduces the new
element after the iteration cursor and that there is a chance that an RCU
reader may in fact use this new element in iteration. The patch uses a
_safe variant of the macro which gets the next element to iterate before
executing the loop body for the current element. The following simple BPF
program can be used to reproduce the issue:
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#define N (64)
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, N);
__type(key, __u64);
__type(value, __u64);
} map SEC(".maps");
static int cb(struct bpf_map *map, __u64 *key, __u64 *value, void *arg) {
bpf_map_delete_elem(map, key);
bpf_map_update_elem(map, key, value, 0);
return 0;
}
SEC("uprobe//proc/self/exe:test")
int BPF_PROG(test) {
__u64 i;
bpf_for(i, 0, N) {
bpf_map_update_elem(&map, &i, &i, 0);
}
bpf_for_each_map_elem(&map, cb, NULL, 0);
return 0;
}
char LICENSE[] SEC("license") = "GPL";
Please put this reproducer into a bpf selftests.
Take a look at tools/testing/selftests/bpf/prog_tests/for_each.c. Adding a
subtest under it should do.
