Re: [PATCH bpf-next v4 3/4] bpf: Add bpf_call_rcu_tasks_trace() kfunc

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: NMI deadlock via call_srcu() in bpf_call_rcu_tasks_trace()
--

commit 04163bb602a2cdfd9c0dc0db4f4484868a98025b
Author: Puranjay Mohan <puranjay@kernel.org>

bpf: Add bpf_call_rcu_tasks_trace() kfunc

This commit introduces bpf_call_rcu_tasks_trace(), a new kfunc that defers
reclaim until after a tasks trace grace period. It builds on the existing
bpf_call_rcu() machinery, but routes the queuing through
call_rcu_tasks_trace() to wait for sleepable BPF programs.

> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
[ ... ]
> @@ -4744,13 +4733,50 @@ __bpf_kfunc int bpf_call_rcu(struct bpf_rcu_head *rh, void *map__const_map,
>  		return -EBADF;
>  	}
>  
> -	rhk->callback_fn = (bpf_callback_t)(void *)callback;
> +	rhk->callback_fn = (bpf_callback_t)callback;
>  	rhk->map = map;
>  	rhk->prog = prog;
> -	call_rcu(&rhk->rcu, bpf_rcu_run_callback);
> +	if (trace)
> +		call_rcu_tasks_trace(&rhk->rcu, bpf_rcu_run_callback);

[Severity: High]
Does this code risk an NMI deadlock?

call_rcu_tasks_trace() is a wrapper for call_srcu(), which acquires the
per-CPU sdp->lock. If this kfunc is called from an NMI context (such as a
BPF tracing program attached to perf_event) while the interrupted context
already holds the sdp->lock on the same CPU, wouldn't this cause a deadlock?

> +	else
> +		call_rcu(&rhk->rcu, bpf_rcu_run_callback);
>  	return 0;
>  }
[ ... ]
> @@ -5045,6 +5071,7 @@ BTF_ID_FLAGS(func, bpf_stream_print_stack, KF_IMPLICIT_ARGS | KF_SPINLOCK_SAFE)
>  BTF_ID_FLAGS(func, bpf_task_work_schedule_signal, KF_IMPLICIT_ARGS)
>  BTF_ID_FLAGS(func, bpf_task_work_schedule_resume, KF_IMPLICIT_ARGS)
>  BTF_ID_FLAGS(func, bpf_call_rcu, KF_IMPLICIT_ARGS)
> +BTF_ID_FLAGS(func, bpf_call_rcu_tasks_trace, KF_IMPLICIT_ARGS)

[Severity: High]
Could we restrict the execution context of this kfunc?

Since bpf_call_rcu_tasks_trace() is registered here without any context
restrictions, it permits use in NMI-context tracing programs, which exposes
the potential deadlock with call_srcu() mentioned above.

>  BTF_ID_FLAGS(func, bpf_dynptr_from_file)
>  BTF_ID_FLAGS(func, bpf_dynptr_file_discard, KF_RELEASE)
>  BTF_ID_FLAGS(func, bpf_timer_cancel_async)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260915154248.3612028-1-puranjay@kernel.org?part=3