From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: "Feng Yang" <yangfeng59949@163.com>, <song@kernel.org>,
<jolsa@kernel.org>, <ihor.solodrai@linux.dev>,
<kpsingh@kernel.org>, <matt@bobrowski.net>,
<daniel@iogearbox.net>, <andrii@kernel.org>, <eddyz87@gmail.com>,
<memxor@gmail.com>, <martin.lau@linux.dev>,
<yonghong.song@linux.dev>, <emil@etsalapatis.com>,
<rostedt@goodmis.org>, <mhiramat@kernel.org>,
<mathieu.desnoyers@efficios.com>
Cc: <bpf@vger.kernel.org>, <linux-trace-kernel@vger.kernel.org>
Subject: Re: [PATCH v2 bpf-next] bpf: Fix suspicious RCU usage for sleepable bpf_get_stack()
Date: Tue, 03 Nov 2026 03:03:02 +0000 [thread overview]
Message-ID: <DML8PRKSQ4ZX.2A8Q5SC26RO6Q@gmail.com> (raw)
In-Reply-To: <20261102073714.1103088-1-yangfeng59949@163.com>
On Sun, Nov 01, 2026 at 11:37 PM Feng Yang <yangfeng59949@163.com> wrote:
> Route these paths to bpf_get_stack_sleepable() and mark the new protos
> might_sleep, since build_id_parse() may fault in file data for
> BPF_F_USER_STACK | BPF_F_USER_BUILD_ID. Sleepable programs that call
> bpf_get_stack() from inside a bpf_rcu_read_lock() region are now rejected
> by the verifier, which is the correct behavior for a helper that can
> sleep.
That's a new feature. It's not a fix for the splat.
Andrii's point in v1 is about build IDs. That's a good reason for this
patch, but the splat needs Songsen's patch anyway:
https://lore.kernel.org/bpf/20261028121859.994-1-yangsongsen@insta360.com/
Songsen's patch this patch
------------------------------------ --------------- -------------
splat in sleepable progs fixed fixed
splat in bpf_wq, task_work callbacks fixed still there
build ID when the page is paged out no yes
progs that load today all load some rejected
Row 2: the callback is sleepable, but its prog is not.
bpf_wq_work() rcu_read_lock_trace() only
callback_fn() prog->sleepable == false
bpf_get_task_stack() may_fault == false
__bpf_get_stack() no rcu_read_lock()
get_callchain_entry() rcu_dereference(): splat
Row 4: sleepable fentry, lsm, iter, syscall and tracepoint progs that
call bpf_get_stack() under bpf_rcu_read_lock() or bpf_preempt_disable()
load fine today. With this patch the verifier rejects them.
It does so even when flags don't have BPF_F_USER_BUILD_ID.
Pls respin it as a feature, with a new subject and commit log
and a selftest.
pw-bot: cr
next prev parent reply other threads:[~2026-11-03 3:03 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-02 7:37 [PATCH v2 bpf-next] bpf: Fix suspicious RCU usage for sleepable bpf_get_stack() Feng Yang
2026-11-02 8:14 ` bot+bpf-ci
2026-11-03 3:03 ` Alexei Starovoitov [this message]
2026-11-03 9:02 ` Feng Yang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DML8PRKSQ4ZX.2A8Q5SC26RO6Q@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=mathieu.desnoyers@efficios.com \
--cc=matt@bobrowski.net \
--cc=memxor@gmail.com \
--cc=mhiramat@kernel.org \
--cc=rostedt@goodmis.org \
--cc=song@kernel.org \
--cc=yangfeng59949@163.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.