Skip to content

B4/kmalloc special#11399

Draft
mykyta5 wants to merge 3 commits intokernel-patches:bpf-next_basefrom
mykyta5:b4/kmalloc_special
Draft

B4/kmalloc special#11399
mykyta5 wants to merge 3 commits intokernel-patches:bpf-next_basefrom
mykyta5:b4/kmalloc_special

Conversation

@mykyta5
Copy link
Contributor

@mykyta5 mykyta5 commented Mar 13, 2026

No description provided.

mykyta5 added 3 commits March 13, 2026 15:47
Now that kmalloc can be used from NMI context via kmalloc_nolock(),
migrate BPF internal allocations away from bpf_mem_alloc to use the
standard slab allocator.

Use kfree_rcu() for deferred freeing, which guarantees both tasks trace
and normal RCU grace periods before the memory is reclaimed.

Patch 1 migrates bpf_task_work_ctx from bpf_mem_alloc/bpf_mem_free to
kmalloc_nolock/kfree_rcu.

Patch 2 migrates bpf_dynptr_file_impl from bpf_mem_alloc/bpf_mem_free
to kmalloc_nolock/kfree_rcu.

Signed-off-by: Mykyta Yatsenko <[email protected]>

--- b4-submit-tracking ---
# This section is used internally by b4 prep for tracking purposes.
{
  "series": {
    "revision": 1,
    "change-id": "20260223-kmalloc_special-933ec4c543d7",
    "prefixes": []
  }
}
Now that kmalloc can be used from NMI context, replace bpf_mem_alloc/
bpf_mem_free with kmalloc_nolock/kfree_rcu for bpf_task_work_ctx.

bpf_task_work_ctx_reset() releases prog and task references while
refcount is zero, before kfree_rcu() defers the actual free.

Sleepable BPF programs (e.g. BPF_PROG_TYPE_SYSCALL) hold
rcu_read_lock_trace but not regular rcu_read_lock. Since kfree_rcu
waits for a regular RCU grace period, the ctx memory can be freed
while a sleepable program is still running. Add explicit
rcu_read_lock/unlock around the pointer read and refcount tryget in
bpf_task_work_acquire_ctx to close this race window.

For the lost-cmpxchg path the ctx was never published, so plain kfree
is safe.
Replace bpf_mem_alloc/bpf_mem_free with kmalloc_nolock/kfree_rcu for
bpf_dynptr_file_impl, continuing the migration away from bpf_mem_alloc
now that kmalloc can be used from NMI context.

freader_cleanup() runs before kfree_rcu() while the dynptr still holds
exclusive access. kfree_rcu() then defers the actual free until after
a grace period.

Add struct rcu_head to bpf_dynptr_file_impl for kfree_rcu().
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant