Re: [PATCH v5 3/8] mm/slab: use call_rcu() in unknown context if irqs are enabled

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The modified fallback condition `!allow_spin && irqs_disabled()` is completely dead code because `allow_spin` evaluates to true unconditionally, rendering the intended NMI protection for `call_rcu()` ineffective.
--

--- Patch [3]: [PATCH v5 3/8] mm/slab: use call_rcu() in unknown context if irqs are enabled ---
commit f7ce8e162ca9c0e62e67afe017d8855bcf7b7674
Author: Harry Yoo (Oracle) <harry@xxxxxxxxxx>

mm/slab: use call_rcu() in unknown context if irqs are enabled

This commit updates the fallback condition in __kfree_rcu_sheaf() to check
if IRQs are disabled, allowing direct use of call_rcu() when IRQs are
enabled. It assumes that if IRQs are enabled, re-entrance into call_rcu()
cannot occur.

Link: https://lore.kernel.org/linux-mm/CAADnVQKRVD5ZSnEKbZZU7w86gHbGHUug2pvzpgZTngNS+fg4rw@xxxxxxxxxxxxxx

> diff --git a/mm/slub.c b/mm/slub.c
> index 2c5ba8c326e73..bb0f2975c95b1 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -6157,8 +6157,12 @@ bool __kfree_rcu_sheaf(struct kmem_cache *s, void *obj, unsigned int free_flags)
>  	if (likely(rcu_sheaf->size < s->sheaf_capacity)) {
>  		rcu_sheaf = NULL;
>  	} else {
> -		if (unlikely(!allow_spin)) {
> -			/* call_rcu() cannot be called in an unknown context */
> +		/*
> +		 * With !allow_spin, we might have interrupted call_rcu()'s
> +		 * IRQ-disabled critical section. If IRQs are not disabled,
> +		 * we know that's not the case.
> +		 */
> +		if (unlikely(!allow_spin && irqs_disabled())) {

[Severity: High]
Does this make the fallback condition completely dead code?

Since __kfree_rcu_sheaf() is only invoked by kfree_rcu_sheaf() in
mm/slab_common.c with the SLAB_FREE_DEFAULT (0) flag:

mm/slab_common.c:kfree_rcu_sheaf() {
    ...
    return __kfree_rcu_sheaf(s, obj, SLAB_FREE_DEFAULT);
}

The allow_spin variable will evaluate to true unconditionally. This makes
!allow_spin always false, which prevents this fallback path from executing.

If an eBPF tracing program calls kfree_rcu() from an NMI context exactly when
the CPU's RCU sheaf becomes full, could the code now invoke call_rcu() and
corrupt RCU per-CPU data structures?

>  			rcu_sheaf->size--;
>  			local_unlock(&s->cpu_sheaves->lock);
>  			goto fail;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729-kfree_rcu_nolock-v5-0-a28cdcda9673@xxxxxxxxxx?part=3