Re: [PATCH 7.1.y v2] selftests/bpf: Add tests for sleepable tracepoint programs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Test codifies a critical kernel crash bug due to incomplete backport of sleepable tracepoint support
--

--- Patch [1]: [PATCH 7.1.y v2] selftests/bpf: Add tests for sleepable tracepoint programs ---
commit d01560ee1bdaeec333977b1890fc06598668aa9f
Author: Mykyta Yatsenko <yatsenko@meta.com>

selftests/bpf: Add tests for sleepable tracepoint programs

Cover all three sleepable tracepoint types (tp_btf.s, raw_tp.s, tp.s)
and sys_exit (via bpf_task_pt_regs) with functional tests using
bpf_copy_from_user() on getcwd.

Link: https://lore.kernel.org/bpf/20260422-sleepable_tracepoints-v13-6-99005dff21ef@meta.com

> diff --git a/tools/testing/selftests/bpf/verifier/sleepable.c b/tools/testing/selftests/bpf/verifier/sleepable.c
> index c2b7f5ebf168c..6dabc55229455 100644
> --- a/tools/testing/selftests/bpf/verifier/sleepable.c
> +++ b/tools/testing/selftests/bpf/verifier/sleepable.c
> @@ -76,7 +76,20 @@
>  	.runs = -1,
>  },
>  {
> -	"sleepable raw tracepoint reject",
> +	"sleepable raw tracepoint accept",
> +	.insns = {
> +	BPF_MOV64_IMM(BPF_REG_0, 0),
> +	BPF_EXIT_INSN(),
> +	},
> +	.prog_type = BPF_PROG_TYPE_TRACING,
> +	.expected_attach_type = BPF_TRACE_RAW_TP,
> +	.kfunc = "sys_enter",
> +	.result = ACCEPT,
> +	.flags = BPF_F_SLEEPABLE,
> +	.runs = -1,
> +},

[Severity: Critical]
This is a pre-existing issue, but does this test codify a kernel crash bug
in the baseline tree?

The commit message notes that kernel-side sleepable tracepoint runtime support
was not backported here. Because of an earlier backport, the verifier
currently accepts sleepable raw tracepoints if tracepoint_is_faultable() is
true (like sys_enter), which makes this verifier test pass.

However, without the runtime support, the execution happens unconditionally
under atomic contexts. For example, in __bpf_trace_run():

kernel/trace/bpf_trace.c:__bpf_trace_run() {
    ...
    rcu_read_lock_dont_migrate();
    ...
}

Or via the tracepoint wrapper:

include/trace/bpf_probe.h:__BPF_DECLARE_TRACE_SYSCALL() {
    ...
    preempt_disable_notrace();
    ...
}

If a sleepable program is attached to this tracepoint and actually sleeps, it
will trigger a scheduling while atomic panic.

Should this test be removed or adjusted until the runtime support is fully
backported to prevent asserting this unsafe verifier state?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260807-selftests-bpf-sleepable-v2-1-f7e6566f36a1@marliere.net?part=1