[PATCH bpf v3 1/2] bpf: Reject sleepable kprobe_multi programs at attach time

[PATCH bpf v3 1/2] bpf: Reject sleepable kprobe_multi programs at attach time

[Varun R Mallya]

kprobe.multi programs run in atomic/RCU context and cannot sleep.
However, bpf_kprobe_multi_link_attach() did not validate whether the
program being attached had the sleepable flag set, allowing sleepable
helpers such as bpf_copy_from_user() to be invoked from a non-sleepable
context.

This causes a "sleeping function called from invalid context" splat:

  BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169
  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1787, name: sudo
  preempt_count: 1, expected: 0
  RCU nest depth: 2, expected: 0

Fix this by rejecting sleepable programs early in
bpf_kprobe_multi_link_attach(), before any further processing.

Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>
---
 kernel/trace/bpf_trace.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 0b040a417442..af7079aa0f36 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2752,6 +2752,10 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
 	if (!is_kprobe_multi(prog))
 		return -EINVAL;
 
+	/* kprobe_multi is not allowed to be sleepable. */
+	if (prog->sleepable)
+		return -EINVAL;
+
 	/* Writing to context is not allowed for kprobes. */
 	if (prog->aux->kprobe_write_ctx)
 		return -EINVAL;
-- 
2.53.0

[PATCH bpf v3 2/2] selftests/bpf: Add test to ensure kprobe_multi is not sleepable

[Varun R Mallya]

Add a selftest to ensure that kprobe_multi programs cannot be attached
using the BPF_F_SLEEPABLE flag. This test succeeds when the kernel
rejects attachment of kprobe_multi when the BPF_F_SLEEPABLE flag is set.

Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>
---
 .../bpf/prog_tests/kprobe_multi_test.c        | 41 +++++++++++++++++++
 .../bpf/progs/kprobe_multi_sleepable.c        | 13 ++++++
 2 files changed, 54 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/progs/kprobe_multi_sleepable.c

diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
index 78c974d4ea33..f02fec2b6fda 100644
--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
@@ -10,6 +10,7 @@
 #include "kprobe_multi_session_cookie.skel.h"
 #include "kprobe_multi_verifier.skel.h"
 #include "kprobe_write_ctx.skel.h"
+#include "kprobe_multi_sleepable.skel.h"
 #include "bpf/libbpf_internal.h"
 #include "bpf/hashmap.h"
 
@@ -633,6 +634,44 @@ static void test_attach_write_ctx(void)
 }
 #endif
 
+static void test_attach_multi_sleepable(void)
+{
+	struct kprobe_multi_sleepable *skel;
+	int err;
+
+	skel = kprobe_multi_sleepable__open();
+	if (!ASSERT_OK_PTR(skel, "kprobe_multi_sleepable__open"))
+		return;
+
+	err = bpf_program__set_flags(skel->progs.handle_kprobe_multi_sleepable,
+				     BPF_F_SLEEPABLE);
+	if (!ASSERT_OK(err, "bpf_program__set_flags"))
+		goto cleanup;
+
+	/* Load should succeed even with BPF_F_SLEEPABLE for KPROBE types */
+	err = kprobe_multi_sleepable__load(skel);
+	if (!ASSERT_OK(err, "kprobe_multi_sleepable__load"))
+		goto cleanup;
+
+	/* Attachment must fail for kprobe.multi + BPF_F_SLEEPABLE.
+	 * Also chosen a stable symbol to send into opts
+	 */
+	LIBBPF_OPTS(bpf_kprobe_multi_opts, opts);
+	const char *sym = "vfs_read";
+
+	opts.syms = &sym;
+	opts.cnt = 1;
+
+	skel->links.handle_kprobe_multi_sleepable =
+		bpf_program__attach_kprobe_multi_opts(skel->progs.handle_kprobe_multi_sleepable,
+						      NULL, &opts);
+	ASSERT_ERR_PTR(skel->links.handle_kprobe_multi_sleepable,
+		       "bpf_program__attach_kprobe_multi_opts");
+
+cleanup:
+	kprobe_multi_sleepable__destroy(skel);
+}
+
 void serial_test_kprobe_multi_bench_attach(void)
 {
 	if (test__start_subtest("kernel"))
@@ -676,5 +715,7 @@ void test_kprobe_multi_test(void)
 		test_unique_match();
 	if (test__start_subtest("attach_write_ctx"))
 		test_attach_write_ctx();
+	if (test__start_subtest("attach_multi_sleepable"))
+		test_attach_multi_sleepable();
 	RUN_TESTS(kprobe_multi_verifier);
 }
diff --git a/tools/testing/selftests/bpf/progs/kprobe_multi_sleepable.c b/tools/testing/selftests/bpf/progs/kprobe_multi_sleepable.c
new file mode 100644
index 000000000000..56973ad8779d
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/kprobe_multi_sleepable.c
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+
+SEC("kprobe.multi")
+int handle_kprobe_multi_sleepable(struct pt_regs *ctx)
+{
+	return 0;
+}
+
+char _license[] SEC("license") = "GPL";
-- 
2.53.0

Re: [PATCH bpf v3 2/2] selftests/bpf: Add test to ensure kprobe_multi is not sleepable

[Kumar Kartikeya Dwivedi]

On Wed, 1 Apr 2026 at 21:11, Varun R Mallya <varunrmallya@gmail.com> wrote:
>
> Add a selftest to ensure that kprobe_multi programs cannot be attached
> using the BPF_F_SLEEPABLE flag. This test succeeds when the kernel
> rejects attachment of kprobe_multi when the BPF_F_SLEEPABLE flag is set.
>
> Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>
> ---

Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

>  .../bpf/prog_tests/kprobe_multi_test.c        | 41 +++++++++++++++++++
>  .../bpf/progs/kprobe_multi_sleepable.c        | 13 ++++++
>  2 files changed, 54 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/progs/kprobe_multi_sleepable.c
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
> index 78c974d4ea33..f02fec2b6fda 100644
> --- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
> +++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
> @@ -10,6 +10,7 @@
>  #include "kprobe_multi_session_cookie.skel.h"
>  #include "kprobe_multi_verifier.skel.h"
>  #include "kprobe_write_ctx.skel.h"
> +#include "kprobe_multi_sleepable.skel.h"
>  #include "bpf/libbpf_internal.h"
>  #include "bpf/hashmap.h"
>
> @@ -633,6 +634,44 @@ static void test_attach_write_ctx(void)
>  }
>  #endif
>
> +static void test_attach_multi_sleepable(void)
> +{
> +       struct kprobe_multi_sleepable *skel;
> +       int err;
> +
> +       skel = kprobe_multi_sleepable__open();
> +       if (!ASSERT_OK_PTR(skel, "kprobe_multi_sleepable__open"))
> +               return;
> +
> +       err = bpf_program__set_flags(skel->progs.handle_kprobe_multi_sleepable,
> +                                    BPF_F_SLEEPABLE);
> +       if (!ASSERT_OK(err, "bpf_program__set_flags"))
> +               goto cleanup;
> +
> +       /* Load should succeed even with BPF_F_SLEEPABLE for KPROBE types */
> +       err = kprobe_multi_sleepable__load(skel);
> +       if (!ASSERT_OK(err, "kprobe_multi_sleepable__load"))
> +               goto cleanup;
> +
> +       /* Attachment must fail for kprobe.multi + BPF_F_SLEEPABLE.
> +        * Also chosen a stable symbol to send into opts
> +        */
> +       LIBBPF_OPTS(bpf_kprobe_multi_opts, opts);
> +       const char *sym = "vfs_read";
> +
> +       opts.syms = &sym;
> +       opts.cnt = 1;
> +
> +       skel->links.handle_kprobe_multi_sleepable =
> +               bpf_program__attach_kprobe_multi_opts(skel->progs.handle_kprobe_multi_sleepable,
> +                                                     NULL, &opts);
> +       ASSERT_ERR_PTR(skel->links.handle_kprobe_multi_sleepable,
> +                      "bpf_program__attach_kprobe_multi_opts");

Nit: While vfs_read will likely remain stable, the check could
probably be stronger to distinguish an attach error from -EINVAL?
I added a typo to vfs_read and it still passed, because it failed to
attach instead of getting rejected on unfixed kernel.
May not be a big deal since vfs_read is unlikely to break.
I verified it works by adding bpf_copy_from_user to the program and
attaching to SYS_PREFIX sys_getpid and invoking the splat though, so
LGTM otherwise.

> +
> +cleanup:
> +       kprobe_multi_sleepable__destroy(skel);
> +}
> +
> [...]

Re: [PATCH bpf v3 2/2] selftests/bpf: Add test to ensure kprobe_multi is not sleepable

[Jiri Olsa]

On Thu, Apr 02, 2026 at 12:50:10AM +0200, Kumar Kartikeya Dwivedi wrote:
> On Wed, 1 Apr 2026 at 21:11, Varun R Mallya <varunrmallya@gmail.com> wrote:
> >
> > Add a selftest to ensure that kprobe_multi programs cannot be attached
> > using the BPF_F_SLEEPABLE flag. This test succeeds when the kernel
> > rejects attachment of kprobe_multi when the BPF_F_SLEEPABLE flag is set.
> >
> > Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>
> > ---
> 
> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> 
> >  .../bpf/prog_tests/kprobe_multi_test.c        | 41 +++++++++++++++++++
> >  .../bpf/progs/kprobe_multi_sleepable.c        | 13 ++++++
> >  2 files changed, 54 insertions(+)
> >  create mode 100644 tools/testing/selftests/bpf/progs/kprobe_multi_sleepable.c
> >
> > diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
> > index 78c974d4ea33..f02fec2b6fda 100644
> > --- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
> > +++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
> > @@ -10,6 +10,7 @@
> >  #include "kprobe_multi_session_cookie.skel.h"
> >  #include "kprobe_multi_verifier.skel.h"
> >  #include "kprobe_write_ctx.skel.h"
> > +#include "kprobe_multi_sleepable.skel.h"
> >  #include "bpf/libbpf_internal.h"
> >  #include "bpf/hashmap.h"
> >
> > @@ -633,6 +634,44 @@ static void test_attach_write_ctx(void)
> >  }
> >  #endif
> >
> > +static void test_attach_multi_sleepable(void)
> > +{
> > +       struct kprobe_multi_sleepable *skel;
> > +       int err;
> > +
> > +       skel = kprobe_multi_sleepable__open();
> > +       if (!ASSERT_OK_PTR(skel, "kprobe_multi_sleepable__open"))
> > +               return;
> > +
> > +       err = bpf_program__set_flags(skel->progs.handle_kprobe_multi_sleepable,
> > +                                    BPF_F_SLEEPABLE);
> > +       if (!ASSERT_OK(err, "bpf_program__set_flags"))
> > +               goto cleanup;
> > +
> > +       /* Load should succeed even with BPF_F_SLEEPABLE for KPROBE types */
> > +       err = kprobe_multi_sleepable__load(skel);
> > +       if (!ASSERT_OK(err, "kprobe_multi_sleepable__load"))
> > +               goto cleanup;
> > +
> > +       /* Attachment must fail for kprobe.multi + BPF_F_SLEEPABLE.
> > +        * Also chosen a stable symbol to send into opts
> > +        */
> > +       LIBBPF_OPTS(bpf_kprobe_multi_opts, opts);
> > +       const char *sym = "vfs_read";
> > +
> > +       opts.syms = &sym;
> > +       opts.cnt = 1;
> > +
> > +       skel->links.handle_kprobe_multi_sleepable =
> > +               bpf_program__attach_kprobe_multi_opts(skel->progs.handle_kprobe_multi_sleepable,
> > +                                                     NULL, &opts);
> > +       ASSERT_ERR_PTR(skel->links.handle_kprobe_multi_sleepable,
> > +                      "bpf_program__attach_kprobe_multi_opts");
> 
> Nit: While vfs_read will likely remain stable, the check could
> probably be stronger to distinguish an attach error from -EINVAL?
> I added a typo to vfs_read and it still passed, because it failed to
> attach instead of getting rejected on unfixed kernel.
> May not be a big deal since vfs_read is unlikely to break.
> I verified it works by adding bpf_copy_from_user to the program and
> attaching to SYS_PREFIX sys_getpid and invoking the splat though, so
> LGTM otherwise.

why not use bpf_fentry_test2 ? you could also put it in pattern argument
and bypass opts completely (up to you)

also there's test_attach_api_fails test, please move it over there

thanks,
jirka

Re: [PATCH bpf v3 2/2] selftests/bpf: Add test to ensure kprobe_multi is not sleepable

[Kumar Kartikeya Dwivedi]

On Thu, 2 Apr 2026 at 11:46, Jiri Olsa <olsajiri@gmail.com> wrote:
>
> On Thu, Apr 02, 2026 at 12:50:10AM +0200, Kumar Kartikeya Dwivedi wrote:
> > On Wed, 1 Apr 2026 at 21:11, Varun R Mallya <varunrmallya@gmail.com> wrote:
> > >
> > > Add a selftest to ensure that kprobe_multi programs cannot be attached
> > > using the BPF_F_SLEEPABLE flag. This test succeeds when the kernel
> > > rejects attachment of kprobe_multi when the BPF_F_SLEEPABLE flag is set.
> > >
> > > Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>
> > > ---
> >
> > Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> >
> > >  .../bpf/prog_tests/kprobe_multi_test.c        | 41 +++++++++++++++++++
> > >  .../bpf/progs/kprobe_multi_sleepable.c        | 13 ++++++
> > >  2 files changed, 54 insertions(+)
> > >  create mode 100644 tools/testing/selftests/bpf/progs/kprobe_multi_sleepable.c
> > >
> > > diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
> > > index 78c974d4ea33..f02fec2b6fda 100644
> > > --- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
> > > +++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
> > > @@ -10,6 +10,7 @@
> > >  #include "kprobe_multi_session_cookie.skel.h"
> > >  #include "kprobe_multi_verifier.skel.h"
> > >  #include "kprobe_write_ctx.skel.h"
> > > +#include "kprobe_multi_sleepable.skel.h"
> > >  #include "bpf/libbpf_internal.h"
> > >  #include "bpf/hashmap.h"
> > >
> > > @@ -633,6 +634,44 @@ static void test_attach_write_ctx(void)
> > >  }
> > >  #endif
> > >
> > > +static void test_attach_multi_sleepable(void)
> > > +{
> > > +       struct kprobe_multi_sleepable *skel;
> > > +       int err;
> > > +
> > > +       skel = kprobe_multi_sleepable__open();
> > > +       if (!ASSERT_OK_PTR(skel, "kprobe_multi_sleepable__open"))
> > > +               return;
> > > +
> > > +       err = bpf_program__set_flags(skel->progs.handle_kprobe_multi_sleepable,
> > > +                                    BPF_F_SLEEPABLE);
> > > +       if (!ASSERT_OK(err, "bpf_program__set_flags"))
> > > +               goto cleanup;
> > > +
> > > +       /* Load should succeed even with BPF_F_SLEEPABLE for KPROBE types */
> > > +       err = kprobe_multi_sleepable__load(skel);
> > > +       if (!ASSERT_OK(err, "kprobe_multi_sleepable__load"))
> > > +               goto cleanup;
> > > +
> > > +       /* Attachment must fail for kprobe.multi + BPF_F_SLEEPABLE.
> > > +        * Also chosen a stable symbol to send into opts
> > > +        */
> > > +       LIBBPF_OPTS(bpf_kprobe_multi_opts, opts);
> > > +       const char *sym = "vfs_read";
> > > +
> > > +       opts.syms = &sym;
> > > +       opts.cnt = 1;
> > > +
> > > +       skel->links.handle_kprobe_multi_sleepable =
> > > +               bpf_program__attach_kprobe_multi_opts(skel->progs.handle_kprobe_multi_sleepable,
> > > +                                                     NULL, &opts);
> > > +       ASSERT_ERR_PTR(skel->links.handle_kprobe_multi_sleepable,
> > > +                      "bpf_program__attach_kprobe_multi_opts");
> >
> > Nit: While vfs_read will likely remain stable, the check could
> > probably be stronger to distinguish an attach error from -EINVAL?
> > I added a typo to vfs_read and it still passed, because it failed to
> > attach instead of getting rejected on unfixed kernel.
> > May not be a big deal since vfs_read is unlikely to break.
> > I verified it works by adding bpf_copy_from_user to the program and
> > attaching to SYS_PREFIX sys_getpid and invoking the splat though, so
> > LGTM otherwise.
>
> why not use bpf_fentry_test2 ? you could also put it in pattern argument
> and bypass opts completely (up to you)
>
> also there's test_attach_api_fails test, please move it over there
>

Varun, the selftest is still not applied, only the fix. Please follow
up and target bpf-next tree this time.
Thanks.

Re: [PATCH bpf v3 2/2] selftests/bpf: Add test to ensure kprobe_multi is not sleepable

[Leon Hwang]

Above all, I think the test should reproduce the BUG without the fix.

I update the test to reproduce the BUG, then verify that the BUG will be
rejected with the fix.

The updated test is attached at last.

On 2/4/26 03:11, Varun R Mallya wrote:
> Add a selftest to ensure that kprobe_multi programs cannot be attached
> using the BPF_F_SLEEPABLE flag. This test succeeds when the kernel
> rejects attachment of kprobe_multi when the BPF_F_SLEEPABLE flag is set.
> 
> Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>
> ---
>  .../bpf/prog_tests/kprobe_multi_test.c        | 41 +++++++++++++++++++
>  .../bpf/progs/kprobe_multi_sleepable.c        | 13 ++++++
>  2 files changed, 54 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/progs/kprobe_multi_sleepable.c
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
> index 78c974d4ea33..f02fec2b6fda 100644
> --- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
> +++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
> @@ -10,6 +10,7 @@
>  #include "kprobe_multi_session_cookie.skel.h"
>  #include "kprobe_multi_verifier.skel.h"
>  #include "kprobe_write_ctx.skel.h"
> +#include "kprobe_multi_sleepable.skel.h"
>  #include "bpf/libbpf_internal.h"
>  #include "bpf/hashmap.h"
>  
> @@ -633,6 +634,44 @@ static void test_attach_write_ctx(void)
>  }
>  #endif
>  
> +static void test_attach_multi_sleepable(void)
> +{
> +	struct kprobe_multi_sleepable *skel;
> +	int err;
> +
> +	skel = kprobe_multi_sleepable__open();
> +	if (!ASSERT_OK_PTR(skel, "kprobe_multi_sleepable__open"))
> +		return;
> +
> +	err = bpf_program__set_flags(skel->progs.handle_kprobe_multi_sleepable,
> +				     BPF_F_SLEEPABLE);
> +	if (!ASSERT_OK(err, "bpf_program__set_flags"))
> +		goto cleanup;
> +
> +	/* Load should succeed even with BPF_F_SLEEPABLE for KPROBE types */
> +	err = kprobe_multi_sleepable__load(skel);
> +	if (!ASSERT_OK(err, "kprobe_multi_sleepable__load"))
> +		goto cleanup;
> +
> +	/* Attachment must fail for kprobe.multi + BPF_F_SLEEPABLE.
> +	 * Also chosen a stable symbol to send into opts
> +	 */
> +	LIBBPF_OPTS(bpf_kprobe_multi_opts, opts);
> +	const char *sym = "vfs_read";

They should stay with skel and err. See below.

> +
> +	opts.syms = &sym;
> +	opts.cnt = 1;
> +
> +	skel->links.handle_kprobe_multi_sleepable =
> +		bpf_program__attach_kprobe_multi_opts(skel->progs.handle_kprobe_multi_sleepable,
> +						      NULL, &opts);
> +	ASSERT_ERR_PTR(skel->links.handle_kprobe_multi_sleepable,
> +		       "bpf_program__attach_kprobe_multi_opts");

As Kumar suggested, better to also verify the error here.

	ASSERT_EQ(libbpf_get_error(skel->links.handle_kprobe_multi_sleepable),
-EINVAL,
		  "bpf_program__attach_kprobe_multi_opts error");

> +
> +cleanup:
> +	kprobe_multi_sleepable__destroy(skel);
> +}
> +

[...]

Thanks,
Leon

---

diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
index 78c974d4ea33..d59cf840da83 100644
--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
@@ -10,6 +10,7 @@
 #include "kprobe_multi_session_cookie.skel.h"
 #include "kprobe_multi_verifier.skel.h"
 #include "kprobe_write_ctx.skel.h"
+#include "kprobe_multi_sleepable.skel.h"
 #include "bpf/libbpf_internal.h"
 #include "bpf/hashmap.h"

@@ -633,6 +634,52 @@ static void test_attach_write_ctx(void)
 }
 #endif

+static void test_attach_multi_sleepable(void)
+{
+       struct kprobe_multi_sleepable *skel;
+       const char *sym = "bpf_fentry_test1";
+       int err;
+       LIBBPF_OPTS(bpf_test_run_opts, topts);
+       LIBBPF_OPTS(bpf_kprobe_multi_opts, opts,
+                   .syms = &sym,
+                   .cnt = 1
+       );
+
+       skel = kprobe_multi_sleepable__open();
+       if (!ASSERT_OK_PTR(skel, "kprobe_multi_sleepable__open"))
+               return;
+
+       skel->bss->user_ptr = skel;
+
+       err =
bpf_program__set_flags(skel->progs.handle_kprobe_multi_sleepable,
+                                    BPF_F_SLEEPABLE);
+       if (!ASSERT_OK(err, "bpf_program__set_flags"))
+               goto cleanup;
+
+       /* Load should succeed even with BPF_F_SLEEPABLE for KPROBE types */
+       err = kprobe_multi_sleepable__load(skel);
+       if (!ASSERT_OK(err, "kprobe_multi_sleepable__load"))
+               goto cleanup;
+
+       /*
+        * Attachment must fail for kprobe.multi + BPF_F_SLEEPABLE.
+        * Also chosen a stable symbol to send into opts
+        */
+       skel->links.handle_kprobe_multi_sleepable =
+
bpf_program__attach_kprobe_multi_opts(skel->progs.handle_kprobe_multi_sleepable,
+                                                     NULL, &opts);
+       ASSERT_ERR_PTR(skel->links.handle_kprobe_multi_sleepable,
+                      "bpf_program__attach_kprobe_multi_opts");
+
ASSERT_EQ(libbpf_get_error(skel->links.handle_kprobe_multi_sleepable),
-EINVAL,
+                 "attach_multi_sleepable_err");
+
+       err =
bpf_prog_test_run_opts(bpf_program__fd(skel->progs.fentry), &topts);
+       ASSERT_OK(err, "bpf_prog_test_run_opts");
+
+cleanup:
+       kprobe_multi_sleepable__destroy(skel);
+}
+
 void serial_test_kprobe_multi_bench_attach(void)
 {
        if (test__start_subtest("kernel"))
@@ -676,5 +723,7 @@ void test_kprobe_multi_test(void)
                test_unique_match();
        if (test__start_subtest("attach_write_ctx"))
                test_attach_write_ctx();
+       if (test__start_subtest("attach_multi_sleepable"))
+               test_attach_multi_sleepable();
        RUN_TESTS(kprobe_multi_verifier);
 }
diff --git a/tools/testing/selftests/bpf/progs/kprobe_multi_sleepable.c
b/tools/testing/selftests/bpf/progs/kprobe_multi_sleepable.c
new file mode 100644
index 000000000000..932e1d9c72e2
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/kprobe_multi_sleepable.c
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+
+void *user_ptr = 0;
+
+SEC("kprobe.multi")
+int handle_kprobe_multi_sleepable(struct pt_regs *ctx)
+{
+       int a, err;
+
+       err = bpf_copy_from_user(&a, sizeof(a), user_ptr);
+       barrier_var(a);
+       return err;
+}
+
+SEC("fentry/bpf_fentry_test1")
+int BPF_PROG(fentry)
+{
+       return 0;
+}
+
+char _license[] SEC("license") = "GPL";

Re: [PATCH bpf v3 1/2] bpf: Reject sleepable kprobe_multi programs at attach time

[Kumar Kartikeya Dwivedi]

On Wed, 1 Apr 2026 at 21:11, Varun R Mallya <varunrmallya@gmail.com> wrote:
>
> kprobe.multi programs run in atomic/RCU context and cannot sleep.
> However, bpf_kprobe_multi_link_attach() did not validate whether the
> program being attached had the sleepable flag set, allowing sleepable
> helpers such as bpf_copy_from_user() to be invoked from a non-sleepable
> context.
>
> This causes a "sleeping function called from invalid context" splat:
>
>   BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169
>   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1787, name: sudo
>   preempt_count: 1, expected: 0
>   RCU nest depth: 2, expected: 0
>
> Fix this by rejecting sleepable programs early in
> bpf_kprobe_multi_link_attach(), before any further processing.
>
> Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
> Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>
> ---

Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

Jiri, would be great if you can ack both patches too.

Re: [PATCH bpf v3 1/2] bpf: Reject sleepable kprobe_multi programs at attach time

[Leon Hwang]

On 2/4/26 03:11, Varun R Mallya wrote:
> kprobe.multi programs run in atomic/RCU context and cannot sleep.
> However, bpf_kprobe_multi_link_attach() did not validate whether the
> program being attached had the sleepable flag set, allowing sleepable
> helpers such as bpf_copy_from_user() to be invoked from a non-sleepable
> context.
> 
> This causes a "sleeping function called from invalid context" splat:
> 
>   BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169
>   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1787, name: sudo
>   preempt_count: 1, expected: 0
>   RCU nest depth: 2, expected: 0
> 
> Fix this by rejecting sleepable programs early in
> bpf_kprobe_multi_link_attach(), before any further processing.
> 
> Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
> Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>

Acked-by: Leon Hwang <leon.hwang@linux.dev>

The cover letter is missing, and the change logs are missing, too.

[...]

Re: [PATCH bpf v3 1/2] bpf: Reject sleepable kprobe_multi programs at attach time

[Jiri Olsa]

On Thu, Apr 02, 2026 at 12:41:25AM +0530, Varun R Mallya wrote:
> kprobe.multi programs run in atomic/RCU context and cannot sleep.
> However, bpf_kprobe_multi_link_attach() did not validate whether the
> program being attached had the sleepable flag set, allowing sleepable
> helpers such as bpf_copy_from_user() to be invoked from a non-sleepable
> context.
> 
> This causes a "sleeping function called from invalid context" splat:
> 
>   BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169
>   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1787, name: sudo
>   preempt_count: 1, expected: 0
>   RCU nest depth: 2, expected: 0
> 
> Fix this by rejecting sleepable programs early in
> bpf_kprobe_multi_link_attach(), before any further processing.
> 
> Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
> Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>

nice catch!

Acked-by: Jiri Olsa <jolsa@kernel.org>

thanks,
jirka


> ---
>  kernel/trace/bpf_trace.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 0b040a417442..af7079aa0f36 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -2752,6 +2752,10 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
>  	if (!is_kprobe_multi(prog))
>  		return -EINVAL;
>  
> +	/* kprobe_multi is not allowed to be sleepable. */
> +	if (prog->sleepable)
> +		return -EINVAL;
> +
>  	/* Writing to context is not allowed for kprobes. */
>  	if (prog->aux->kprobe_write_ctx)
>  		return -EINVAL;
> -- 
> 2.53.0
> 

Re: [PATCH bpf v3 1/2] bpf: Reject sleepable kprobe_multi programs at attach time

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Thu,  2 Apr 2026 00:41:25 +0530 you wrote:
> kprobe.multi programs run in atomic/RCU context and cannot sleep.
> However, bpf_kprobe_multi_link_attach() did not validate whether the
> program being attached had the sleepable flag set, allowing sleepable
> helpers such as bpf_copy_from_user() to be invoked from a non-sleepable
> context.
> 
> This causes a "sleeping function called from invalid context" splat:
> 
> [...]

Here is the summary with links:
  - [bpf,v3,1/2] bpf: Reject sleepable kprobe_multi programs at attach time
    https://git.kernel.org/bpf/bpf/c/eb7024bfcc5f
  - [bpf,v3,2/2] selftests/bpf: Add test to ensure kprobe_multi is not sleepable
    (no matching commit)

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html