Re: [RFC PATCH v4] bpf: introduce TAINT_UNSAFE_BPF for mutating helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Race condition allows an unsafe BPF program to execute and potentially crash the kernel before the taint is applied.
--

commit e1d80dc0708bef39b15f2ef93cbdb5c71cbc352e
Author: Aaron Tomlin <atomlin@atomlin.com>
bpf: introduce TAINT_UNSAFE_BPF for mutating helpers

This patch introduces a new kernel taint flag, TAINT_UNSAFE_BPF, which is
set when an eBPF program utilizing destructive or mutating helpers is loaded.
This provides an auditable indicator that the kernel's execution flow or
memory may have been compromised by eBPF.

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3109,6 +3109,13 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
>  	perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_LOAD, 0);
>  	bpf_audit_prog(prog, BPF_AUDIT_LOAD);
>  
> +	/*
> +	 * The program has passed the verifier and is now publicly exposed.
> +	 * If it utilises unsafe helpers, formally taint the kernel now.
> +	 */
> +	if (prog->aux->taints_kernel)
> +		add_taint(TAINT_UNSAFE_BPF, LOCKDEP_STILL_OK);

Could this leave a small race window where an unsafe program executes before
the taint is applied?

Looking earlier in bpf_prog_load(), the program is added to the IDR via
bpf_prog_alloc_id(prog). If a concurrent thread polls for this new ID using
bpf_prog_get_fd_by_id(), could it attach and execute the program before this
thread reaches add_taint()?

If the unsafe program causes a crash during this window, the resulting dump
might not have the TAINT_UNSAFE_BPF flag set. Should the taint be applied
before the program is placed in the IDR?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260503190119.559696-1-atomlin@atomlin.com?part=1