Re: [PATCH] bpf: arena: reschedule while freeing the arena pages

[Breno Leitao <leitao@debian.org>]

On Mon, Aug 24, 2026 at 05:08:30PM +0000, sashiko-bot@kernel.org wrote:
> > diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c
> > index 7b6847200b431..c5f6bebbb15c3 100644
> > --- a/kernel/bpf/arena.c
> > +++ b/kernel/bpf/arena.c
> > @@ -364,6 +364,7 @@ static int existing_page_cb(pte_t *ptep, unsigned long addr, void *data)
> >  	 * the freed page. So it all relies on 1.
> >  	 */
> >  	__free_page(page);
> > +	cond_resched();
> 
> [Severity: High]
> Does adding cond_resched() here violate the lazy MMU mode contract?
> 
> The callback existing_page_cb() is a pte_fn_t called by apply_to_pte_range(),
> which establishes an atomic context by wrapping the callback loop in
> lazy_mmu_mode_enable():
> 
> mm/memory.c:apply_to_pte_range() {
> ...
> 	lazy_mmu_mode_enable();
> 	if (fn) {
> 		do {
> 			if (create || !pte_none(ptep_get(pte))) {
> 				err = fn(pte, addr, data);
> ...
> }
> 
> On architectures like PowerPC64 with hash MMUs, lazy_mmu_mode_enable()
> explicitly disables preemption. Since preemption is disabled, cond_resched()
> evaluates to a no-op, which means it won't actually yield the CPU and will
> fail to resolve the original softlockup.
> 
> Additionally, if CONFIG_DEBUG_ATOMIC_SLEEP is enabled, this could trigger a
> "sleeping function called from invalid context" bug during teardown.

That is a good point, I think a better approach would be to drop the
cond_resched() from the callback -- existing_page_cb() goes back to its
original form.

Then we walks the range in chunks from arena_map_free() instead, so the
resched happens outside the lazy MMU section (FREE_CHUNK_SZ is SZ_64M):

      addr = bpf_arena_get_kern_vm_start(arena);
      end = addr + SZ_4G + GUARD_SZ / 2;
      while (addr < end) {
              u64 size = min_t(u64, end - addr, FREE_CHUNK_SZ);

              apply_to_existing_page_range(&init_mm, addr, size,
                                           existing_page_cb, arena);
              cond_resched();
              addr += size;
      }

Would this be a better approach?
--breno