Re: [PATCH bpf-next 1/2] bpf: Fix task work round ownership during cancellation

[luyun <luyun_611@163.com>]

在 2026/9/19 01:54, Alexei Starovoitov 写道:
> On Fri Sep 18, 2026 at 8:00 AM UTC, Yun Lu wrote:
>>   struct bpf_task_work_ctx {
>>   	enum bpf_task_work_state state;
>>   	refcount_t refcnt;
>> +	/*
>> +	 * References to task/prog/work in the current scheduling round.  The
>> +	 * STANDBY -> PENDING transition serializes initialization from zero.
>> +	 */
>> +	refcount_t round_refs;
>>   	struct callback_head work;
>>   	struct irq_work irq_work;
>> +	struct irq_work cancel_irq_work;
>> +	struct irq_work destroy_irq_work;
> This is overkill. Find a different way to fix it.


Hi, Alexei

Thanks for reviewing, this has been dropped in v2.

Instead of the extra refcount and irq_work objects, v2 adds a
completion edge: the callback claims RUNNING and waits for the
scheduling irq_work invocation with irq_work_sync() before it resets
task/prog or publishes STANDBY.  One temporary reference from the
existing ctx refcount covers the window where the callback bails out
on FREED before the handler's cancellation attempt, and a BUSY check
in acquire covers the add-failure path.  No fields or states are added
to the context, and the cancel/destroy paths are unchanged.

v2: https://lore.kernel.org/all/20260921101453.69273-2-luyun_611@163.com/


---

Thanks,

Yun Lu



>
> pw-bot: cr