Re: [PATCH] bpf: Run deferred program freeing on system_dfl_long_wq

[Andrii Nakryiko]

On Sun, Jul 19, 2026 at 8:31 PM Richard Cheng <icheng@xxxxxxxxxx> wrote:
>
> Destroying APT's seccomp BPF programs can spend over 20ms in arm64 JIT
> text invalidation. bpf_jit_free() calls kick_all_cpus_sync(), which is
> especially expensive on system with many CPUs.
>
> schedule_work() uses a per-CPU workqueue, causing:
>
> """
> [204351.169849] workqueue: bpf_prog_free_deferred hogged CPU for
> >20000us 5 times, consider switching to WQ_UNBOUND
> """
>
> This is triggered during a normal "sudo apt update -y"
>
> Queue the cleanup on system_dfl_long_wq, the unbound queue intended for
> long-running work, to avoid delaying concurrency-managed per-CPU
> workers.
>
> Signed-off-by: Richard Cheng <icheng@xxxxxxxxxx>
> ---
>  kernel/bpf/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 6e19a030da6f..a2ca6bdfb6f5 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -3115,7 +3115,7 @@ void bpf_prog_free(struct bpf_prog *fp)
>                 bpf_prog_put(aux->dst_prog);
>         bpf_token_put(aux->token);
>         INIT_WORK(&aux->work, bpf_prog_free_deferred);
> -       schedule_work(&aux->work);
> +       queue_work(system_dfl_long_wq, &aux->work);


schedule_work() is using system_percpu_wq, and it seems like the
closest equivalent for long-running work would be system_long_wq
(per-CPU queue), not system_dfl_long_wq (system-wide). I don't really
know why we use per-CPU queue here, but wouldn't it be logical to
stick to per-CPU queue to keep the behavior as close as possible to
the original logic?

>  }
>  EXPORT_SYMBOL_GPL(bpf_prog_free);
>
> --
> 2.43.0
>