Re: [PATCH bpf-next 1/2] bpf: Fix sleepable check for tracing prog

[Leon Hwang <leon.hwang@linux.dev>]

On 2026/7/24 23:41, Viktor Malik wrote:
> On 7/24/26 16:14, Leon Hwang wrote:
>> When CONFIG_FUNCTION_ERROR_INJECTION is disabled, a sleepable tracing prog
>> is allowed to attach to '__x64_'-alike prefix symbols.
>>
>> It is because the verifier does not verify whether the symbol is a kernel
>> function or a bpf prog. That said, a sleepable tracing prog is allowed to
>> attach to a bpf prog target whose name has '__x64_'-alike prefix.
>>
>> For example, a sleepable fentry prog attaches to a '__x64_sys_nop' XDP
>> prog, and copies buffer from a user pointer with bpf_copy_from_user()
>> helper. After attaching the XDP prog to lo interface, the kernel BUG
>> could be triggered by 'ping -c 1 -W 1 127.0.0.1':
>>
>> [    3.460756] BUG: sleeping function called from invalid context at kernel/bpf/trampoline.c:1324
>>
>> Fix it by disallowing sleepable tracing prog always when its target is
>> bpf prog.
>>
>> Fixes: 16d9c5660692 ("bpf: Always allow sleepable programs on syscalls")
>> Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
>> ---
>>  kernel/bpf/verifier.c | 9 ++++++---
>>  1 file changed, 6 insertions(+), 3 deletions(-)
>>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 52be0a118cce..40d567b90d24 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -18935,13 +18935,16 @@ static bool is_tracing_multi_id(const struct bpf_prog *prog, u32 btf_id)
>>  }
>>  
>>  static int btf_id_allow_sleepable(u32 btf_id, unsigned long addr, const struct bpf_prog *prog,
>> -				  const struct btf *btf)
>> +				  const struct btf *btf, const struct bpf_prog *tgt_prog)
>>  {
>>  	const struct btf_type *t;
>>  	const char *tname;
>>  
>>  	switch (prog->type) {
>>  	case BPF_PROG_TYPE_TRACING:
>> +		if (tgt_prog)
>> +			return prog->sleepable ? -EINVAL : 0;
> 
> The prog->sleepable check is redundant since btf_id_allow_sleepable() is
> only called if prog->sleepable is true.


Good catch.

Will drop the prog->sleepable check.

> 
> Other than that:
> 
> Acked-by: Viktor Malik <vmalik@redhat.com>

Thanks for your review.

Leon

> [...]