[PATCH bpf-next] bpf: Add __bpfcall attribute to bpf_task_work_callback()

[PATCH bpf-next] bpf: Add __bpfcall attribute to bpf_task_work_callback()

[Heiko Carstens]

BPF kCFI support is optional for architectures which support kCFI.
If an architecture provides bpf kCFI support it must override the
default __bpfcall define (which translates to __nocfi).

Add the missing __bpfcall attribute to bpf_task_work_callback() which
calls bpf programs indirectly to avoid CFI checks for such cases.

Fixes: 38aa7003e369 ("bpf: task work scheduling kfuncs")
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 kernel/bpf/helpers.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 88b38db47de9..9bf82c9ea1da 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -4447,7 +4447,7 @@ static void bpf_task_work_cancel(struct bpf_task_work_ctx *ctx)
 		bpf_task_work_ctx_put(ctx);
 }
 
-static void bpf_task_work_callback(struct callback_head *cb)
+static __bpfcall void bpf_task_work_callback(struct callback_head *cb)
 {
 	struct bpf_task_work_ctx *ctx = container_of(cb, struct bpf_task_work_ctx, work);
 	enum bpf_task_work_state state;
-- 
2.53.0

Re: [PATCH bpf-next] bpf: Add __bpfcall attribute to bpf_task_work_callback()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Incomplete Fix / Missing kCFI Annotations for BPF indirect calls
--

--- Patch [1]: [PATCH bpf-next] bpf: Add __bpfcall attribute to bpf_task_work_callback() ---
commit 96f705949126224922cfe1979dd000057319d199
Author: Heiko Carstens <hca@linux.ibm.com>

bpf: Add __bpfcall attribute to bpf_task_work_callback()

This commit adds the __bpfcall attribute to bpf_task_work_callback() to
avoid CFI checks for indirect calls to BPF programs. This addresses kCFI
issues on architectures that do not provide default BPF kCFI support.

> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index 88b38db47de92..9bf82c9ea1dac 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -4447,7 +4447,7 @@ static void bpf_task_work_cancel(struct bpf_task_work_ctx *ctx)
>  		bpf_task_work_ctx_put(ctx);
>  }
>  
> -static void bpf_task_work_callback(struct callback_head *cb)
> +static __bpfcall void bpf_task_work_callback(struct callback_head *cb)
>  {

[Severity: Critical]
This isn't a bug introduced by this patch, but are there other BPF indirect 
calls that also need the __bpfcall attribute to prevent kCFI panics?

For example, bpf_timer_cb() and bpf_wq_work() in kernel/bpf/helpers.c also 
perform indirect calls to callback_fn(). 

Other locations like bpf_for_each_array_elem() in kernel/bpf/arraymap.c and 
bpf_find_vma() in kernel/bpf/task_iter.c appear to have the same pattern. 

Could unprivileged users loading BPF programs that use timers, workqueues, 
or map iterators trigger the same kCFI violation on architectures lacking BPF 
kCFI support?

>  	struct bpf_task_work_ctx *ctx = container_of(cb, struct bpf_task_work_ctx, work);
>  	enum bpf_task_work_state state;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727093834.2178900-1-hca@linux.ibm.com?part=1

Re: [PATCH bpf-next] bpf: Add __bpfcall attribute to bpf_task_work_callback()

[Mykyta Yatsenko]

On 7/27/26 10:38 AM, Heiko Carstens wrote:
> BPF kCFI support is optional for architectures which support kCFI.
> If an architecture provides bpf kCFI support it must override the
> default __bpfcall define (which translates to __nocfi).
> 
> Add the missing __bpfcall attribute to bpf_task_work_callback() which
> calls bpf programs indirectly to avoid CFI checks for such cases.
> 
> Fixes: 38aa7003e369 ("bpf: task work scheduling kfuncs")
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>  kernel/bpf/helpers.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index 88b38db47de9..9bf82c9ea1da 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -4447,7 +4447,7 @@ static void bpf_task_work_cancel(struct bpf_task_work_ctx *ctx)
>  		bpf_task_work_ctx_put(ctx);
>  }
>  
> -static void bpf_task_work_callback(struct callback_head *cb)
> +static __bpfcall void bpf_task_work_callback(struct callback_head *cb)

Thanks for the patch, I've already sent another fix:
https://lore.kernel.org/all/20260724-task_work_cfi-v1-1-2616691781ed@meta.com/
Is __bpfcall still needed?

>  {
>  	struct bpf_task_work_ctx *ctx = container_of(cb, struct bpf_task_work_ctx, work);
>  	enum bpf_task_work_state state;

Re: [PATCH bpf-next] bpf: Add __bpfcall attribute to bpf_task_work_callback()

[Heiko Carstens]

On Mon, Jul 27, 2026 at 02:09:12PM +0100, Mykyta Yatsenko wrote:
> On 7/27/26 10:38 AM, Heiko Carstens wrote:
> > BPF kCFI support is optional for architectures which support kCFI.
> > If an architecture provides bpf kCFI support it must override the
> > default __bpfcall define (which translates to __nocfi).
> > 
> > Add the missing __bpfcall attribute to bpf_task_work_callback() which
> > calls bpf programs indirectly to avoid CFI checks for such cases.
> > 
> > Fixes: 38aa7003e369 ("bpf: task work scheduling kfuncs")
> > Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> > ---
> >  kernel/bpf/helpers.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> > index 88b38db47de9..9bf82c9ea1da 100644
> > --- a/kernel/bpf/helpers.c
> > +++ b/kernel/bpf/helpers.c
> > @@ -4447,7 +4447,7 @@ static void bpf_task_work_cancel(struct bpf_task_work_ctx *ctx)
> >  		bpf_task_work_ctx_put(ctx);
> >  }
> >  
> > -static void bpf_task_work_callback(struct callback_head *cb)
> > +static __bpfcall void bpf_task_work_callback(struct callback_head *cb)
> 
> Thanks for the patch, I've already sent another fix:
> https://lore.kernel.org/all/20260724-task_work_cfi-v1-1-2616691781ed@meta.com/
> Is __bpfcall still needed?

Yes, it is needed for architectures which select ARCH_SUPPORTS_CFI, and which
in addition support bpf, but do not provide CFI support for bpf programs.

As of now it looks like this is only the case for arm, at least as far as I
understand the code. It might be easier to implement bpf/cfi support for arm,
then drop the __bpfcall macro entirely, and require from future architectures
to provde bpf/cfi support whenever they select ARCH_SUPPORTS_CFI.

I'm writing the above, since due to AI feedback to this patch, there seem to
be more bpf functions which call bpf programs indirectly and which miss the
__bpfcall attribute.