[PATCH bpf-next 0/4] bpf: Fix NMI deadlock in referenced kptr destructors

[Justin Suess <utilityemal77@gmail.com>]

Hello,

While following up on a Sashiko report [1], I found that referenced kptr
destructors can run from NMI context. One way to trigger this is from a
tracing program attached to tp_btf/nmi_handler while a map element is
being torn down.

That is problematic because referenced kptr destructor paths are not
universally NMI-safe. In particular, they may rely on operations such as
call_rcu(), which can deadlock when reached from NMI context.

This series fixes that by deferring referenced kptr destruction out of
NMI context. The core change adds auxiliary per-kptr metadata so NMI-side
teardown can queue pending destructions on a lockless list and schedule
irq_work to drain that list from a safe context.

Because BTF teardown now needs to synchronize that deferred work, the
series first switches final BTF freeing from a plain RCU callback to
rcu_work. There is also a small preparatory cleanup to make
btf_record_equal() compare only the record fields that should participate
in equality checks, which avoids treating the new auxiliary data as part
of the logical record contents.

The last patch adds a selftest based on the reproducer from the report
[2]. It exercises task kptr destruction from NMI context for both array
and htab maps. The deadlock itself is timing-dependent and easier to hit
with CONFIG_RCU_NOCB_CPU, but the test validates that the fixed path
completes without hanging.

I confirmed that under the conditions in the reproducer in [2] that the
kernel will deadlock, and after this series the same reproducer passes
without the kernel complaining.

Kind regards,
Justin Suess

[1] https://lore.kernel.org/bpf/20260421010536.17FB1C19425@smtp.kernel.org/
[2] https://lore.kernel.org/bpf/20260421201035.1729473-1-utilityemal77@gmail.com/

Justin Suess (4):
  bpf: Limit fields used in btf_record_equal comparisons
  bpf: Use rcu_work in BTF teardown
  bpf: Fix deadlock in kptr dtor in nmi
  selftests/bpf: Add kptr nmi deadlock reproducer

 include/linux/bpf.h                           |  69 ++++
 kernel/bpf/arraymap.c                         |  36 ++-
 kernel/bpf/bpf_local_storage.c                |  13 +-
 kernel/bpf/btf.c                              |  22 +-
 kernel/bpf/hashtab.c                          | 181 +++++++++--
 kernel/bpf/syscall.c                          | 210 +++++++++++-
 .../prog_tests/task_kptr_nmi_deadlock_repro.c | 305 ++++++++++++++++++
 .../bpf/progs/task_kptr_nmi_deadlock_repro.c  | 217 +++++++++++++
 8 files changed, 1006 insertions(+), 47 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/task_kptr_nmi_deadlock_repro.c
 create mode 100644 tools/testing/selftests/bpf/progs/task_kptr_nmi_deadlock_repro.c


base-commit: 9f5b3ffc3f1dac7204e32eeeff84bc5cc55c393e
-- 
2.53.0