Re: [PATCH bpf-next v1 1/6] bpf: Add file descriptor interface for program streams

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Race condition in bpf_stream_file_read() leading to premature EOF and data loss.
--

commit 15d530fc84e28348bbaf5fc7ae04276f6622bc6f
Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Date:   Sun Aug 30 09:35:06 2026 +0000

bpf: Add file descriptor interface for program streams

This commit adds a BPF_PROG_STREAM_OPEN command to return a read-only file
descriptor for a selected program stream. It supports blocking and
non-blocking reads, as well as polling, and handles program teardown by
marking the stream dead and waking up descriptor users.

> diff --git a/kernel/bpf/stream.c b/kernel/bpf/stream.c
> index 2b80a0599865e..d3dbb1aca792f 100644
> --- a/kernel/bpf/stream.c
> +++ b/kernel/bpf/stream.c
[ ... ]
> @@ -215,6 +220,102 @@ int bpf_prog_stream_read(struct bpf_prog *prog, enum bpf_stream_id stream_id, vo
>  	return bpf_stream_read(stream, buf, len);
>  }
>  
[ ... ]
> +static ssize_t bpf_stream_file_read(struct file *file, char __user *buf, size_t len,
> +				    loff_t *ppos)
> +{
> +	struct bpf_stream *stream = file->private_data;
> +	int ret;
> +
> +	if (len > INT_MAX)
> +		return -EINVAL;
> +	if (!len)
> +		return 0;
> +
> +	for (;;) {
> +		ret = bpf_stream_read(stream, buf, len);
> +		if (ret)
> +			return ret;
> +		if (READ_ONCE(stream->dead))
> +			return 0;

[Severity: Medium]
Does this code have a race condition that could lead to premature EOF and
missing the final stream events?

If a reader thread gets preempted right after bpf_stream_read() returns 0,
but before checking the stream->dead flag, it leaves a small race window.
Concurrently, a BPF program could emit new data and then be immediately
destroyed, which marks the stream as dead.

When the reader thread resumes, it will see READ_ONCE(stream->dead) as true
and return 0 (EOF) immediately. Would this cause the reader to completely
miss the newly published data that was emitted just before the teardown?

> +		if (file->f_flags & O_NONBLOCK)
> +			return -EAGAIN;
> +
> +		ret = wait_event_interruptible(stream->waitq,
> +					       bpf_stream_has_data(stream) ||
> +					       READ_ONCE(stream->dead));
> +		if (ret)
> +			return ret;
> +	}
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260830093514.4105972-1-memxor@gmail.com?part=1