Re: [PATCH bpf-next v6 1/3] bpf: Factor out stack_map build ID helpers

[Ihor Solodrai <ihor.solodrai@linux.dev>]

On 2026-05-21 4:16 p.m., sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Data race and incorrect ordering in stack_map_build_id_set_valid causing stale reads
> --
> 
> commit 4eb2cc8713ca7f31dcbc75f5166e94dd60761e7c
> Author: Ihor Solodrai <ihor.solodrai@linux.dev>
> 
> bpf: Factor out stack_map build ID helpers
> 
> This commit factors out helpers from stack_map_get_build_id_offset() to
> prepare for adding a sleepable build ID resolution path. The commit
> message states there are no functional changes.
> 
>> diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
>> index da3d328f5c15a..4c753e02c4159 100644
>> --- a/kernel/bpf/stackmap.c
>> +++ b/kernel/bpf/stackmap.c
> [ ... ]
>> @@ -152,6 +152,28 @@ static int fetch_build_id(struct vm_area_struct *vma, unsigned char *build_id, b
> [ ... ]
>> +static inline void stack_map_build_id_set_valid(struct bpf_stack_build_id *id,
>> +						u64 offset,
>> +						const unsigned char *build_id)
>> +{
>> +	id->status = BPF_STACK_BUILD_ID_VALID;
> 
> [Severity: Medium]
> In bpf_get_stack(), the destination buffer can be a BPF map value that is
> concurrently readable locklessly by user-space. Since the buffer initially
> contains the raw instruction pointer (ip), does setting status to VALID
> before writing the offset create a data race?

This is a good point. Will fix in the next version.

> 
> A concurrent lockless reader polling the status field might observe the
> VALID status while the union still holds the raw ip instead of the correct
> file offset, and before the build_id string is fully copied.
> 
> Prior to this patch, the offset was written before the status. Could this
> reordering of assignments cause concurrent readers to observe stale data?
> 
>> +	id->offset = offset;
>> +	if (id->build_id != build_id)
>> +		memcpy(id->build_id, build_id, BUILD_ID_SIZE_MAX);
>> +}
>