bpf: refactor __bpf_list_del to take list node pointer

Refactor __bpf_list_del to accept (head, struct list_head *n) instead of
(head, bool tail). The caller now passes the specific node to remove:
bpf_list_pop_front passes h->next, bpf_list_pop_back passes h->prev.

Prepares for introducing bpf_list_del(head, node) kfunc to remove an
arbitrary node when the user holds ownership.

Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn>
Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260521032306.97118-2-kaitao.cheng@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 07de26e7314cf12eac771cda9eb9393014589c7e..094457c3e6d37d5d4d29bc7cdf2bc2db6da87730 100644 (file)
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -2550,37 +2550,44 @@ __bpf_kfunc int bpf_list_push_back_impl(struct bpf_list_head *head,
        return bpf_list_push_back(head, node, meta__ign, off);
 }
 
-static struct bpf_list_node *__bpf_list_del(struct bpf_list_head *head, bool tail)
+static struct bpf_list_node *__bpf_list_del(struct bpf_list_head *head,
+                                           struct list_head *n)
 {
-       struct list_head *n, *h = (void *)head;
+       struct list_head *h = (void *)head;
        struct bpf_list_node_kern *node;
 
        /* If list_head was 0-initialized by map, bpf_obj_init_field wasn't
         * called on its fields, so init here
         */
-       if (unlikely(!h->next))
+       if (unlikely(!h->next)) {
                INIT_LIST_HEAD(h);
+               return NULL;
+       }
        if (list_empty(h))
                return NULL;
 
-       n = tail ? h->prev : h->next;
        node = container_of(n, struct bpf_list_node_kern, list_head);
-       if (WARN_ON_ONCE(READ_ONCE(node->owner) != head))
+       if (unlikely(READ_ONCE(node->owner) != head))
                return NULL;
 
        list_del_init(n);
-       WRITE_ONCE(node->owner, NULL);
+       /* Ensure __bpf_list_add() sees the node as unlinked. */
+       smp_store_release(&node->owner, NULL);
        return (struct bpf_list_node *)n;
 }
 
 __bpf_kfunc struct bpf_list_node *bpf_list_pop_front(struct bpf_list_head *head)
 {
-       return __bpf_list_del(head, false);
+       struct list_head *h = (void *)head;
+
+       return __bpf_list_del(head, h->next);
 }
 
 __bpf_kfunc struct bpf_list_node *bpf_list_pop_back(struct bpf_list_head *head)
 {
-       return __bpf_list_del(head, true);
+       struct list_head *h = (void *)head;
+
+       return __bpf_list_del(head, h->prev);
 }
 
 __bpf_kfunc struct bpf_list_node *bpf_list_front(struct bpf_list_head *head)