tools/testing/selftests/bpf/progs/timer_start_deadlock.c

// SPDX-License-Identifier: GPL-2.0
/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
#include <vmlinux.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>

#define CLOCK_MONOTONIC 1

char _license[] SEC("license") = "GPL";

struct elem {
	struct bpf_timer timer;
};

struct {
	__uint(type, BPF_MAP_TYPE_ARRAY);
	__uint(max_entries, 1);
	__type(key, int);
	__type(value, struct elem);
} timer_map SEC(".maps");

volatile int in_timer_start;
volatile int tp_called;

static int timer_cb(void *map, int *key, struct elem *value)
{
	return 0;
}

SEC("tp_btf/hrtimer_cancel")
int BPF_PROG(tp_hrtimer_cancel, struct hrtimer *hrtimer)
{
	struct bpf_timer *timer;
	int key = 0;

	if (!in_timer_start)
		return 0;

	tp_called = 1;
	timer = bpf_map_lookup_elem(&timer_map, &key);

	/*
	 * Call bpf_timer_start() from the tracepoint within hrtimer logic
	 * on the same timer to make sure it doesn't deadlock.
	 */
	bpf_timer_start(timer, 1000000000, 0);
	return 0;
}

SEC("syscall")
int start_timer(void *ctx)
{
	struct bpf_timer *timer;
	int key = 0;

	timer = bpf_map_lookup_elem(&timer_map, &key);
	/* claude may complain here that there is no NULL check. Ignoring it. */
	bpf_timer_init(timer, &timer_map, CLOCK_MONOTONIC);
	bpf_timer_set_callback(timer, timer_cb);

	/*
	 * call hrtimer_start() twice, so that 2nd call does
	 * remove_hrtimer() and trace_hrtimer_cancel() tracepoint.
	 */
	in_timer_start = 1;
	bpf_timer_start(timer, 1000000000, 0);
	bpf_timer_start(timer, 1000000000, 0);
	in_timer_start = 0;
	return 0;
}