Re: [PATCH bpf-next v6 4/6] bpf: Verifier support for sleepable tracepoint programs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Sleepable BPF_PROG_TYPE_RAW_TRACEPOINT programs cause a 'scheduling while atomic' kernel panic when executed via BPF_PROG_TEST_RUN.
--

--- Patch [4]: [PATCH bpf-next v6 4/6] bpf: Verifier support for sleepable tracepoint programs ---
commit 0adc028b1ba3ebb449f79abbe66b1d15d4ba5578
Author: Mykyta Yatsenko <yatsenko@meta.com>

bpf: Verifier support for sleepable tracepoint programs

This commit allows BPF_PROG_TYPE_RAW_TRACEPOINT, BPF_PROG_TYPE_TRACEPOINT, and
BPF_TRACE_RAW_TP programs to be sleepable. It also adds checks to ensure
these sleepable programs are only attached to faultable tracepoints.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 01c18f4268deb..a4836f564cb12 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c

[ ... ]

> @@ -25478,7 +25485,9 @@ static bool can_be_sleepable(struct bpf_prog *prog)
>  	}
>  	return prog->type == BPF_PROG_TYPE_LSM ||
>  	       prog->type == BPF_PROG_TYPE_KPROBE /* only for uprobes */ ||
> -	       prog->type == BPF_PROG_TYPE_STRUCT_OPS;
> +	       prog->type == BPF_PROG_TYPE_STRUCT_OPS ||
> +	       prog->type == BPF_PROG_TYPE_RAW_TRACEPOINT ||
> +	       prog->type == BPF_PROG_TYPE_TRACEPOINT;
>  }

[Severity: High]
Can this change introduce a 'scheduling while atomic' kernel panic when a
sleepable BPF_PROG_TYPE_RAW_TRACEPOINT program is executed via
BPF_PROG_TEST_RUN?

Looking at net/bpf/test_run.c, bpf_prog_test_run_raw_tp() disables preemption
via get_cpu() or smp_call_function_single() before running the program:

net/bpf/test_run.c:bpf_prog_test_run_raw_tp() {
	current_cpu = get_cpu();
	if ((kattr->test.flags & BPF_F_TEST_RUN_ON_CPU) == 0 ||
	    cpu == current_cpu) {
		__bpf_prog_test_run_raw_tp(&info);
	} else if (cpu >= nr_cpu_ids || !cpu_online(cpu)) {
		err = -ENXIO;
	} else {
		err = smp_call_function_single(cpu, __bpf_prog_test_run_raw_tp,
					       &info, 1);
	}
	put_cpu();
}

And __bpf_prog_test_run_raw_tp() then executes the program under
rcu_read_lock():

net/bpf/test_run.c:__bpf_prog_test_run_raw_tp() {
	rcu_read_lock();
	info->retval = bpf_prog_run(info->prog, info->ctx);
	rcu_read_unlock();
}

If a user with CAP_BPF loads a sleepable raw tracepoint program and executes it
via the BPF_PROG_TEST_RUN syscall, wouldn't invoking sleepable helpers in this
context trigger a 'BUG: scheduling while atomic' panic?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260324-sleepable_tracepoints-v6-0-81bab3a43f25@meta.com?part=4