Re: [PATCH bpf-next v8 7/9] bpf: task work scheduling kfuncs

[Heiko Carstens <hca@linux.ibm.com>]

On Tue, Sep 23, 2025 at 12:24:02PM +0100, Mykyta Yatsenko wrote:
> From: Mykyta Yatsenko <yatsenko@meta.com>
> 
> Implementation of the new bpf_task_work_schedule kfuncs, that let a BPF
> program schedule task_work callbacks for a target task:
>  * bpf_task_work_schedule_signal() - schedules with TWA_SIGNAL
>  * bpf_task_work_schedule_resume() - schedules with TWA_RESUME

...

> Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
> Reviewed-by: Andrii Nakryiko <andrii@kernel.org>
> Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---
>  kernel/bpf/helpers.c | 292 ++++++++++++++++++++++++++++++++++++++++++-
>  1 file changed, 290 insertions(+), 2 deletions(-)

...

> +static void bpf_task_work_callback(struct callback_head *cb)
> +{
...
> +	migrate_disable();
> +	ctx->callback_fn(ctx->map, key, ctx->map_val);
> +	migrate_enable();

The above indirect call results in a CFI failure - while trying to make kCFI
work on s390, and running the bpf selftests I stumbled across this, which can
also be reproduced on x86:

[   29.357395] CFI failure at bpf_task_work_callback+0x168/0x280 (target: bpf_prog_8ce783214b8218cc_task_work_callback+0x0/0x50f; expected type: 0x37c2b4a2)
[   29.360146] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[   29.360960] CPU: 0 UID: 0 PID: 124 Comm: test_progs Tainted: G           OE       7.2.0-rc4-00365-g48a5a7ab8d6a-dirty #1 PREEMPT(full) 
[   29.361698] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[   29.362027] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/10/2025
[   29.362625] RIP: 0010:bpf_task_work_callback+0x168/0x280

The problem is that above callback_fn is of type

typedef int (*bpf_task_work_callback_t)(struct bpf_map *map, void *key, void *value);

while in fact the indirectly called bpf subprogram has a function type of

typedef u64 (*bpf_callback_t)(u64, u64, u64, u64, u64);

which doesn't match and which subsequently leads to the above crash when called.
This can be reproduced with the following steps:

cd tools/testing/selftests/bpf/

Change vmtest.sh to make use of clang:

-       local make_command="make ARCH=${ARCH} CROSS_COMPILE=${CROSS_COMPILE} \
+       local make_command="make LLVM=1 ARCH=${ARCH} CROSS_COMPILE=${CROSS_COMPILE} \

Add CONFIG_CFI=y to config.x86_64 and then run

./vmtest.sh -- ./test_progs -t task_work