Re: [PATCH] bpf: arena: reschedule while freeing the arena pages

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Calling cond_resched() inside a pte_fn_t callback violates the lazy_mmu_mode contract, causing 'scheduling while atomic' bugs and failing to resolve softlockups on architectures where lazy MMU mode disables preemption.
--

--- Patch [1]: [PATCH] bpf: arena: reschedule while freeing the arena pages ---
commit aff4ff38f5c4bf3ce9d58e40df7c294fa156e787
Author: Breno Leitao <[email protected]>

bpf: arena: reschedule while freeing the arena pages

This commit adds a cond_resched() call to the page freeing callback used
when tearing down a BPF arena to prevent softlockups.

> diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c
> index 7b6847200b431..c5f6bebbb15c3 100644
> --- a/kernel/bpf/arena.c
> +++ b/kernel/bpf/arena.c
> @@ -364,6 +364,7 @@ static int existing_page_cb(pte_t *ptep, unsigned long addr, void *data)
>  	 * the freed page. So it all relies on 1.
>  	 */
>  	__free_page(page);
> +	cond_resched();

[Severity: High]
Does adding cond_resched() here violate the lazy MMU mode contract?

The callback existing_page_cb() is a pte_fn_t called by apply_to_pte_range(),
which establishes an atomic context by wrapping the callback loop in
lazy_mmu_mode_enable():

mm/memory.c:apply_to_pte_range() {
...
	lazy_mmu_mode_enable();
	if (fn) {
		do {
			if (create || !pte_none(ptep_get(pte))) {
				err = fn(pte, addr, data);
...
}

On architectures like PowerPC64 with hash MMUs, lazy_mmu_mode_enable()
explicitly disables preemption. Since preemption is disabled, cond_resched()
evaluates to a no-op, which means it won't actually yield the CPU and will
fail to resolve the original softlockup.

Additionally, if CONFIG_DEBUG_ATOMIC_SLEEP is enabled, this could trigger a
"sleeping function called from invalid context" bug during teardown.

>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1