Re: [PATCH bpf-next v5 3/4] bpf: Add bpf_call_rcu_tasks_trace() kfunc

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: bpf_call_rcu/tasks_trace() deadlock and corruption from NMI context
--

commit 7357eb51c5d591938af8ac0c27619c6dee0b07c7
Author: Puranjay Mohan <puranjay@kernel.org>

    bpf: Add bpf_call_rcu_tasks_trace() kfunc

    This commit adds a new bpf kfunc, bpf_call_rcu_tasks_trace(), to defer
    reclaim until after an RCU tasks trace grace period. It is intended for
    sleepable BPF programs and shares the backend __bpf_call_rcu() with
    bpf_call_rcu().

> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index 8a01dd4058a03..301b35bd85c8a 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
[ ... ]
> @@ -4872,13 +4861,50 @@ __bpf_kfunc int bpf_call_rcu(struct bpf_rcu_head *rh, void *map__const_map,
>  		return -EBADF;
>  	}
>  
> -	rhk->callback_fn = (bpf_callback_t)(void *)callback;
> +	rhk->callback_fn = (bpf_callback_t)callback;
>  	rhk->map = map;
>  	rhk->prog = prog;
> -	call_rcu(&rhk->rcu, bpf_rcu_run_callback);
> +	if (trace)
> +		call_rcu_tasks_trace(&rhk->rcu, bpf_rcu_run_callback);

[Severity: High]
Can this branch cause a deadlock if called from NMI context?

A BPF program of type BPF_PROG_TYPE_PERF_EVENT executing in NMI context
could call bpf_call_rcu_tasks_trace(), which delegates to
call_rcu_tasks_trace() and ultimately call_srcu().

Since call_srcu() relies on acquiring a raw spinlock, could an NMI
interrupting a CPU already holding that lock lead to a guaranteed deadlock?

> +	else
> +		call_rcu(&rhk->rcu, bpf_rcu_run_callback);

[Severity: High]
Can this branch corrupt RCU callback lists if called from NMI context?

Similarly, bpf_call_rcu() delegates to call_rcu(), which modifies CPU-local
lists under local_irq_save(). Since local_irq_save() does not block NMIs,
could an NMI interrupting an existing call_rcu() on the same CPU result
in list corruption?

>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921191407.1742386-1-puranjay@kernel.org?part=3