BPF typed arenas RFC seeks trusted kptrs without lifetime hell

Kumar Kartikeya Dwivedi has posted an RFC series on the BPF mailing list for typed arenas: kernel-only memory beside an arena map that holds a program's own struct types, including trusted kernel pointers (kptrs), at fixed slots. Programs would reach those objects through ordinary pointers. The verifier would trust the special fields and would not track object lifetime, because every address in the region always resolves to a valid object of its type.

The gap is real. Arena memory is mapped into user space and can be written freely, so today the verifier cannot trust a kptr loaded from it. A program that builds graphs in the arena and wants to hang a task, socket, or allocated object off a node must stash the reference in a separate map and look it up by key, or lean on sched-ext style ID indirection. The alternative, bpf_obj_new(), pushes every object's lifetime into static analysis: drop or move before exit, share only with refcounts, read shared objects under RCU or locks. Dwivedi wrote that this model "has proven pretty inflexible in practice, and requires kernel changes for each new data structure."

Typed arenas flip the model. The region is mapped only in the kernel, written only under verifier rules, and always live. New kfuncs would allocate and release page-backed chunks (release deferred behind a grace period so fields can be torn down cleanly). Clang would insert a typed-arena cast wherever a pointer to such a struct is formed or used as an address, so programs never write the cast by hand; the verifier decides per path whether the value needs sanitization. Structs carrying spinlocks, timers, refcounts, list heads, or rbtree roots stay out of scope. The series is explicitly RFC: reviewers are asked to weigh the sandboxing approach and tradeoffs, not the unfinished details.

An automated review bot still walked the concrete code and reported multiple serious problems. Among them: physical pages freed before TLB flush, a use-after-free from missing PTE cleanup on teardown, a stale-TLB window on an allocation error path, a TOCTOU double-fetch on the user-supplied page count, unaligned free that can release adjacent chunks, a cast path that can drop a non-zero offset at runtime while the verifier keeps it, uninitialized kernel memory exposure, and races between the deferred free worker and the page-fault path. Several findings were rated critical or high.

If the design holds after those issues are closed, BPF programs that today juggle map keys or rigid ownership graphs could keep native, verifier-trusted object graphs in arena memory without teaching the kernel a new data structure for each shape. That matters for schedulers, networking, and any subsystem already stretching arena and kptr machinery past their current limits.