Re: [PATCH bpf-next v12 1/6] bpf: Add sleepable support for raw tracepoint programs

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [Medium] Adding `bpf_prog_get_recursion_context()` to `__bpf_prog_test_run_raw_tp()` causes concurrent test runs of sleepable programs on the same CPU to silently fail and report success (returning 0) to user-space.
--

commit 222c8798357569a257ba54fe2c8b4e389e16e925
Author: Mykyta Yatsenko <yatsenko@meta.com>
Subject: bpf: Add sleepable support for raw tracepoint programs

This commit reworks __bpf_trace_run() and bpf_prog_test_run_raw_tp() to
support sleepable BPF programs by using explicit RCU flavor selection and
adding per-program recursion context guards.

> diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
> --- a/net/bpf/test_run.c
> +++ b/net/bpf/test_run.c
[ ... ]
> @@ -748,14 +748,35 @@ static void
>  __bpf_prog_test_run_raw_tp(void *data)
>  {
>  	struct bpf_raw_tp_test_run_info *info = data;
[ ... ]
> -	rcu_read_lock();
> +	if (info->prog->sleepable) {
> +		scp = rcu_read_lock_tasks_trace();
> +		migrate_disable();
> +	} else {
> +		rcu_read_lock();
> +	}
> +
> +	if (unlikely(!bpf_prog_get_recursion_context(info->prog))) {
> +		bpf_prog_inc_misses_counter(info->prog);
> +		goto out;
> +	}
> +
>  	info->retval = bpf_prog_run(info->prog, info->ctx);
> -	rcu_read_unlock();
> +
> +out:
> +	bpf_prog_put_recursion_context(info->prog);

Does this introduce a regression where concurrent test runs of sleepable
programs silently skip execution and report success?

For sleepable programs, execution can block. Even with migrate_disable() held,
the task can yield the CPU while the per-CPU counter from
bpf_prog_get_recursion_context() remains incremented.

If another userspace thread executes a test run for the same sleepable
program and is scheduled on the same CPU, it will read the incremented
counter and falsely detect recursion.

This causes the second run to jump out and skip bpf_prog_run(). Because
info->retval is initialized to 0 and no error is returned, the test run will
silently succeed and copy 0 back to userspace.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260422-sleepable_tracepoints-v12-0-744bf0e3b311@meta.com?part=1