Re: [PATCH v3 3/4] block: add BPF kfuncs to read blkcg io.stat

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Calling bpf_css_release() from NMI context can trigger a deadlock.
--

--- Patch [3]: [PATCH v3 3/4] block: add BPF kfuncs to read blkcg io.stat ---
commit d71e52907eeb75ca126ab0da4391bc18134b90e2
Author: Ziyang Men <ziyang.meme@gmail.com>

block: add BPF kfuncs to read blkcg io.stat

This commit adds BPF kfuncs to acquire and release a controller's css from a
cgroup. It also adds a kfunc to cast an io controller css to its block
cgroup, along with an open-coded iterator for the per-device blkgs.

> diff --git a/kernel/cgroup/bpf_cgroup.c b/kernel/cgroup/bpf_cgroup.c
> index cd28c838dc7b6..e253633e82782 100644
> --- a/kernel/cgroup/bpf_cgroup.c
> +++ b/kernel/cgroup/bpf_cgroup.c
[ ... ]
> +/**
> + * bpf_css_release - Release a css reference
> + * @css: css to release
> + */
> +__bpf_kfunc void bpf_css_release(struct cgroup_subsys_state *css)
> +{
> +	css_put(css);
> +}

[Severity: High]
Can this trigger a deadlock if called from NMI context?

Since these kfuncs are registered under BPF_PROG_TYPE_UNSPEC, they can be
called by NMI-context BPF programs such as perf events. 

If a BPF program drops the last reference to the css here, css_put() will
invoke the percpu_ref release callback, css_release(), directly in the NMI
context. 

css_release() unconditionally calls queue_work(), which internally acquires
the workqueue pool's raw spinlock. If the NMI interrupted a context that
already held this lock, would this instantly deadlock the system?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260820211758.3393984-1-ziyang.meme@gmail.com?part=3