[PATCH bpf] bpf: Report RCU-tasks quiescent states in do_check()

[PATCH bpf] bpf: Report RCU-tasks quiescent states in do_check()

[Breno Leitao]

I am seeing rcu_tasks stalls in the Meta fleet on debug kernels (KASAN,
kmemleak, lockdep), where a task loading a BPF program stays in the
verifier for over 20 minutes:

  INFO: rcu_tasks detected stalls on tasks:
  000000000cc1a43d: .. nvcsw: 4/4 holdout: 1 idle_cpu: -1/91 task:GlobalCPUThread state:R  running task  pid:175256 tgid:169948 ppid:1
  Call Trace:
   __create_object
   __kmalloc_node_track_caller_noprof
   krealloc_node_align_noprof
   copy_array
   bpf_copy_verifier_state
   bpf_split_cur_state
   do_check_common
   do_check_main
   bpf_check
   bpf_prog_load
   __sys_bpf

The main loop in do_check() only calls cond_resched(), which is a no-op
on PREEMPTION kernels. Involuntary preemption is not a Tasks-RCU
quiescent state, so the loading task never reports one and stays a
holdout until bpf_prog_load() returns. Meanwhile every
synchronize_rcu_tasks() caller waits, e.g. ftrace_shutdown() of a
dynamic ftrace_ops.

Upgrade it to cond_resched_tasks_rcu_qs(), which reports a quiescent
state even when cond_resched() does nothing. The need_resched() check
goes away, as cond_resched() does it already.

Fixes: 3c2ce60bdd3d ("bpf: adjust verifier heuristics")
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 kernel/bpf/verifier.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 5e4700fda66b9f..232551fd7cefdd 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -20627,8 +20627,7 @@ static int do_check(struct bpf_verifier_env *env)
 		if (signal_pending(current))
 			return -EAGAIN;
 
-		if (need_resched())
-			cond_resched();
+		cond_resched_tasks_rcu_qs();
 
 		/* reset current history entry on each new instruction */
 		env->cur_hist_ent = NULL;

---
base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47
change-id: 20261110-bpf-verifier-rcu-tasks-qs-bb523c1febe9

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH bpf] bpf: Report RCU-tasks quiescent states in do_check()

[Paul E. McKenney]

On Tue, Nov 10, 2026 at 04:18:32AM -0800, Breno Leitao wrote:
> I am seeing rcu_tasks stalls in the Meta fleet on debug kernels (KASAN,
> kmemleak, lockdep), where a task loading a BPF program stays in the
> verifier for over 20 minutes:
> 
>   INFO: rcu_tasks detected stalls on tasks:
>   000000000cc1a43d: .. nvcsw: 4/4 holdout: 1 idle_cpu: -1/91 task:GlobalCPUThread state:R  running task  pid:175256 tgid:169948 ppid:1
>   Call Trace:
>    __create_object
>    __kmalloc_node_track_caller_noprof
>    krealloc_node_align_noprof
>    copy_array
>    bpf_copy_verifier_state
>    bpf_split_cur_state
>    do_check_common
>    do_check_main
>    bpf_check
>    bpf_prog_load
>    __sys_bpf
> 
> The main loop in do_check() only calls cond_resched(), which is a no-op
> on PREEMPTION kernels. Involuntary preemption is not a Tasks-RCU
> quiescent state, so the loading task never reports one and stays a
> holdout until bpf_prog_load() returns. Meanwhile every
> synchronize_rcu_tasks() caller waits, e.g. ftrace_shutdown() of a
> dynamic ftrace_ops.
> 
> Upgrade it to cond_resched_tasks_rcu_qs(), which reports a quiescent
> state even when cond_resched() does nothing. The need_resched() check
> goes away, as cond_resched() does it already.
> 
> Fixes: 3c2ce60bdd3d ("bpf: adjust verifier heuristics")
> Signed-off-by: Breno Leitao <leitao@debian.org>

Reviewed-by: Paul E. McKenney <paulmck@kernel.org>

> ---
>  kernel/bpf/verifier.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 5e4700fda66b9f..232551fd7cefdd 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -20627,8 +20627,7 @@ static int do_check(struct bpf_verifier_env *env)
>  		if (signal_pending(current))
>  			return -EAGAIN;
>  
> -		if (need_resched())
> -			cond_resched();
> +		cond_resched_tasks_rcu_qs();
>  
>  		/* reset current history entry on each new instruction */
>  		env->cur_hist_ent = NULL;
> 
> ---
> base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47
> change-id: 20261110-bpf-verifier-rcu-tasks-qs-bb523c1febe9
> 
> Best regards,
> --  
> Breno Leitao <leitao@debian.org>
> 

Re: [PATCH bpf] bpf: Report RCU-tasks quiescent states in do_check()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Tue, 10 Nov 2026 04:18:32 -0800 you wrote:
> I am seeing rcu_tasks stalls in the Meta fleet on debug kernels (KASAN,
> kmemleak, lockdep), where a task loading a BPF program stays in the
> verifier for over 20 minutes:
> 
>   INFO: rcu_tasks detected stalls on tasks:
>   000000000cc1a43d: .. nvcsw: 4/4 holdout: 1 idle_cpu: -1/91 task:GlobalCPUThread state:R  running task  pid:175256 tgid:169948 ppid:1
>   Call Trace:
>    __create_object
>    __kmalloc_node_track_caller_noprof
>    krealloc_node_align_noprof
>    copy_array
>    bpf_copy_verifier_state
>    bpf_split_cur_state
>    do_check_common
>    do_check_main
>    bpf_check
>    bpf_prog_load
>    __sys_bpf
> 
> [...]

Here is the summary with links:
  - [bpf] bpf: Report RCU-tasks quiescent states in do_check()
    https://git.kernel.org/bpf/bpf/c/7f1e33230b7c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html