Re: [PATCH bpf v1 09/10] bpf: Mark syscall helpers as sleepable

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Thu Sep 3, 2026 at 5:51 PM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> Pre-existing issues:
> - [High] bpf_btf_find_by_name_kind_proto lacks .might_sleep = true, allowing arbitrary FD injection via softirq.
> --
>
> commit 1d16e876066d61c09bcc6698ca694cdf8336d52c
> Author: Kumar Kartikeya Dwivedi <memxor@gmail.com>
>
> bpf: Mark syscall helpers as sleepable
>
> This commit adds the .might_sleep = true constraint to the bpf_sys_bpf and
> bpf_sys_close helper prototypes. This ensures the verifier rejects them from
> non-sleepable contexts, such as bpf_timer callbacks registered within a
> BPF_PROG_TYPE_SYSCALL program.
>
>> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
>> index 6874ba1424af0..c7bc9ba9b331f 100644
>> --- a/kernel/bpf/syscall.c
>> +++ b/kernel/bpf/syscall.c
>> @@ -6568,6 +6568,7 @@ EXPORT_SYMBOL_NS(kern_sys_bpf, "BPF_INTERNAL");
>>  static const struct bpf_func_proto bpf_sys_bpf_proto = {
>>  	.func		= bpf_sys_bpf,
>>  	.gpl_only	= false,
>> +	.might_sleep	= true,
>>  	.ret_type	= RET_INTEGER,
>>  	.arg1_type	= ARG_ANYTHING,
>>  	.arg2_type	= ARG_PTR_TO_MEM | MEM_RDONLY,
>>  	.arg3_type	= ARG_MEM_SIZE,
>>  };
>> @@ -6593,6 +6594,7 @@ BPF_CALL_1(bpf_sys_close, u32, fd)
>>  static const struct bpf_func_proto bpf_sys_close_proto = {
>>  	.func		= bpf_sys_close,
>>  	.gpl_only	= false,
>> +	.might_sleep	= true,
>>  	.ret_type	= RET_INTEGER,
>>  	.arg1_type	= ARG_ANYTHING,
>>  };
>
> [Severity: High]
> This isn't a bug introduced by this patch, but does
> bpf_btf_find_by_name_kind_proto also need to be marked as sleepable?
>
> Looking at syscall_prog_func_proto() in kernel/bpf/syscall.c,
> bpf_btf_find_by_name_kind is also exposed to syscall programs:
>
>     case BPF_FUNC_btf_find_by_name_kind:
>         return &bpf_btf_find_by_name_kind_proto;
>
> Because bpf_btf_find_by_name_kind_proto in kernel/bpf/btf.c lacks the
> .might_sleep = true constraint, the verifier will permit its use inside a
> non-sleepable bpf_timer callback registered by a syscall program.
>
> When the timer fires in softirq context, bpf_btf_find_by_name_kind() calls
> __btf_new_fd(). This attempts to allocate a file descriptor with GFP_KERNEL
> and injects the new file descriptor into the current->files struct of
> whatever arbitrary process was interrupted by the timer.
>
> Should bpf_btf_find_by_name_kind_proto be updated as well to prevent this
> cross-process file descriptor injection and scheduling-while-atomic issue?

Yes, this also looks broken. Will fix after this set lands.