[PATCH v7 0/5] bpf: Expand the usage scenarios of bpf_kptr_xchg

From: Chengkaitao

Date: Fri Feb 13 2026 - 23:36:50 EST


From: Kaitao Cheng <chengkaitao@xxxxxxxxxx>

When using bpf_kptr_xchg, we triggered the following error:
31: (85) call bpf_kptr_xchg#194
function calls are not allowed while holding a lock
bpf_kptr_xchg can now be used in lock-held contexts, so we extended
its usage scope in [patch 1/5].

When writing test cases using bpf_kptr_xchg and bpf_rbtree_*, the
following approach must be followed:

bpf_spin_lock(&lock);
rb_n = bpf_rbtree_root(&root);
while (rb_n && can_loop) {
rb_n = bpf_rbtree_remove(&root, rb_n);
if (!rb_n)
goto fail;

tnode = container_of(rb_n, struct tree_node, node);
node_data = bpf_kptr_xchg(&tnode->node_data, NULL);
if (!node_data)
goto fail;

data = node_data->data;
/* use data to do something */

node_data = bpf_kptr_xchg(&tnode->node_data, node_data);
if (node_data)
goto fail;

bpf_rbtree_add(&root, rb_n, less);

if (lookup_key < tnode->key)
rb_n = bpf_rbtree_left(&root, rb_n);
else
rb_n = bpf_rbtree_right(&root, rb_n);
}
bpf_spin_unlock(&lock);

The above illustrates a lock-remove-read-add-unlock workflow, which
exhibits lower performance. To address this, we introduced support
for a streamlined lock-read-unlock operation in [patch 2/5] and
[patch 4/5].

Changes in v7:
- Add a comma to the variable declaration in enum bpf_reg_type
- Modify the prefixes
Changes in v6:
- allow using bpf_kptr_xchg even if the MEM_RCU flag is set
- Add test case
Changes in v5:
- add lastname
Changes in v4:
- Fix the dead logic issue in the test case
Changes in v3:
- Fix compilation errors
Changes in v2:
- Allow using bpf_kptr_xchg even if the NON_OWN_REF flag is set
- Add test case

Link to v6:
https://lore.kernel.org/all/20260208024846.18653-1-pilgrimtao@xxxxxxxxx/
Link to v5:
https://lore.kernel.org/all/20260203022712.99347-1-pilgrimtao@xxxxxxxxx/
Link to v4:
https://lore.kernel.org/all/20260202090051.87802-1-pilgrimtao@xxxxxxxxx/
Link to V3:
https://lore.kernel.org/all/20260202055818.78231-1-pilgrimtao@xxxxxxxxx/
Link to V2:
https://lore.kernel.org/all/20260201031607.32940-1-pilgrimtao@xxxxxxxxx/
Link to V1:
https://lore.kernel.org/all/20260122081426.78472-1-pilgrimtao@xxxxxxxxx/

Kaitao Cheng (5):
bpf: allow calling bpf_kptr_xchg while holding a lock
bpf: allow using bpf_kptr_xchg even if the NON_OWN_REF flag is set
selftests/bpf: Add supplementary tests for bpf_kptr_xchg
bpf: allow using bpf_kptr_xchg even if the MEM_RCU flag is set
selftests/bpf: Add test case for rbtree nodes that contain both
bpf_refcount and kptr fields.

kernel/bpf/verifier.c | 9 +-
.../testing/selftests/bpf/prog_tests/rbtree.c | 6 +
tools/testing/selftests/bpf/progs/bpf_misc.h | 4 +
.../selftests/bpf/progs/rbtree_search_kptr.c | 290 ++++++++++++++++++
4 files changed, 307 insertions(+), 2 deletions(-)
create mode 100644 tools/testing/selftests/bpf/progs/rbtree_search_kptr.c

--
2.50.1 (Apple Git-155)