Re: [PATCH bpf-next v5 1/4] bpf: Add bpf_call_rcu() kfunc

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: bpf_call_rcu() causes deadlock when called from NMI context
--

commit 088862a20bc8f57242ca8bd55ca1e35a37a5380f
Author: Puranjay Mohan <puranjay@kernel.org>

bpf: Add bpf_call_rcu() kfunc

This commit adds a bpf_call_rcu() kfunc, allowing BPF programs to
queue custom callbacks to run after an RCU grace period. It embeds
a struct bpf_rcu_head inside a BPF map value to hold the callback state.

> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index 501c7ce35cba9..8a01dd4058a03 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c

[ ... ]

> @@ -4805,6 +4805,80 @@ __bpf_kfunc int bpf_task_work_schedule_resume(struct task_struct *task, struct b

[ ... ]

> +__bpf_kfunc int bpf_call_rcu(struct bpf_rcu_head *rh, void *map__const_map,
> +			     bpf_rcu_callback_t callback, struct bpf_prog_aux *aux)
> +{
> +	struct bpf_rcu_head_kern *rhk = (void *)rh;
> +	struct bpf_map *map = map__const_map;
> +	struct bpf_prog *prog;

[ ... ]

> +	rhk->callback_fn = (bpf_callback_t)(void *)callback;
> +	rhk->map = map;
> +	rhk->prog = prog;
> +	call_rcu(&rhk->rcu, bpf_rcu_run_callback);

[Severity: High]
Does this code trigger a deadlock if bpf_call_rcu() is called from an NMI
context? 

The call_rcu() function acquires raw spinlocks internally. If a BPF program
executing in NMI context (such as a kprobe or BPF_PROG_TYPE_PERF_EVENT) calls
this while interrupting a thread that already holds the same RCU lock, the CPU
will try to acquire the non-reentrant raw spinlock again and hard deadlock.

Should there be an in_nmi() check here or deferral via irq_work_queue() when
called from an NMI context?

> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921191407.1742386-1-puranjay@kernel.org?part=1