Re: [PATCH bpf v1 09/10] bpf: Mark syscall helpers as sleepable

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] bpf_btf_find_by_name_kind_proto lacks .might_sleep = true, allowing arbitrary FD injection via softirq.
--

commit 1d16e876066d61c09bcc6698ca694cdf8336d52c
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>

bpf: Mark syscall helpers as sleepable

This commit adds the .might_sleep = true constraint to the bpf_sys_bpf and
bpf_sys_close helper prototypes. This ensures the verifier rejects them from
non-sleepable contexts, such as bpf_timer callbacks registered within a
BPF_PROG_TYPE_SYSCALL program.

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 6874ba1424af0..c7bc9ba9b331f 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -6568,6 +6568,7 @@ EXPORT_SYMBOL_NS(kern_sys_bpf, "BPF_INTERNAL");
>  static const struct bpf_func_proto bpf_sys_bpf_proto = {
>  	.func		= bpf_sys_bpf,
>  	.gpl_only	= false,
> +	.might_sleep	= true,
>  	.ret_type	= RET_INTEGER,
>  	.arg1_type	= ARG_ANYTHING,
>  	.arg2_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
>  	.arg3_type	= ARG_MEM_SIZE,
>  };
> @@ -6593,6 +6594,7 @@ BPF_CALL_1(bpf_sys_close, u32, fd)
>  static const struct bpf_func_proto bpf_sys_close_proto = {
>  	.func		= bpf_sys_close,
>  	.gpl_only	= false,
> +	.might_sleep	= true,
>  	.ret_type	= RET_INTEGER,
>  	.arg1_type	= ARG_ANYTHING,
>  };

[Severity: High]
This isn't a bug introduced by this patch, but does
bpf_btf_find_by_name_kind_proto also need to be marked as sleepable?

Looking at syscall_prog_func_proto() in kernel/bpf/syscall.c,
bpf_btf_find_by_name_kind is also exposed to syscall programs:

    case BPF_FUNC_btf_find_by_name_kind:
        return &bpf_btf_find_by_name_kind_proto;

Because bpf_btf_find_by_name_kind_proto in kernel/bpf/btf.c lacks the
.might_sleep = true constraint, the verifier will permit its use inside a
non-sleepable bpf_timer callback registered by a syscall program.

When the timer fires in softirq context, bpf_btf_find_by_name_kind() calls
__btf_new_fd(). This attempts to allocate a file descriptor with GFP_KERNEL
and injects the new file descriptor into the current->files struct of
whatever arbitrary process was interrupted by the timer.

Should bpf_btf_find_by_name_kind_proto be updated as well to prevent this
cross-process file descriptor injection and scheduling-while-atomic issue?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903144433.1716731-1-memxor@gmail.com?part=9