Re: [PATCH bpf-next] bpf: Add __bpfcall attribute to bpf_task_work_callback()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Incomplete Fix / Missing kCFI Annotations for BPF indirect calls
--

--- Patch [1]: [PATCH bpf-next] bpf: Add __bpfcall attribute to bpf_task_work_callback() ---
commit 96f705949126224922cfe1979dd000057319d199
Author: Heiko Carstens <hca@linux.ibm.com>

bpf: Add __bpfcall attribute to bpf_task_work_callback()

This commit adds the __bpfcall attribute to bpf_task_work_callback() to
avoid CFI checks for indirect calls to BPF programs. This addresses kCFI
issues on architectures that do not provide default BPF kCFI support.

> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index 88b38db47de92..9bf82c9ea1dac 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -4447,7 +4447,7 @@ static void bpf_task_work_cancel(struct bpf_task_work_ctx *ctx)
>  		bpf_task_work_ctx_put(ctx);
>  }
>  
> -static void bpf_task_work_callback(struct callback_head *cb)
> +static __bpfcall void bpf_task_work_callback(struct callback_head *cb)
>  {

[Severity: Critical]
This isn't a bug introduced by this patch, but are there other BPF indirect 
calls that also need the __bpfcall attribute to prevent kCFI panics?

For example, bpf_timer_cb() and bpf_wq_work() in kernel/bpf/helpers.c also 
perform indirect calls to callback_fn(). 

Other locations like bpf_for_each_array_elem() in kernel/bpf/arraymap.c and 
bpf_find_vma() in kernel/bpf/task_iter.c appear to have the same pattern. 

Could unprivileged users loading BPF programs that use timers, workqueues, 
or map iterators trigger the same kCFI violation on architectures lacking BPF 
kCFI support?

>  	struct bpf_task_work_ctx *ctx = container_of(cb, struct bpf_task_work_ctx, work);
>  	enum bpf_task_work_state state;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727093834.2178900-1-hca@linux.ibm.com?part=1