Linux kernel -stable discussions
 help / color / mirror / Atom feed
* [PATCH stable 6.6 1/2] bpf: Reject sleepable kprobe_multi programs at attach time
@ 2026-06-24  7:28 Shung-Hsi Yu
  2026-06-24  7:29 ` [PATCH stable 6.6 2/2] selftests/bpf: Add test to ensure kprobe_multi is not sleepable Shung-Hsi Yu
  2026-06-25 10:41 ` [PATCH stable 6.6 1/2] bpf: Reject sleepable kprobe_multi programs at attach time Sasha Levin
  0 siblings, 2 replies; 3+ messages in thread
From: Shung-Hsi Yu @ 2026-06-24  7:28 UTC (permalink / raw)
  To: stable
  Cc: Shung-Hsi Yu, Varun R Mallya, Kumar Kartikeya Dwivedi, Leon Hwang,
	Jiri Olsa, Alexei Starovoitov

From: Varun R Mallya <varunrmallya@gmail.com>

commit eb7024bfcc5f68ed11ed9dd4891a3073c15f04a8 upstream.

kprobe.multi programs run in atomic/RCU context and cannot sleep.
However, bpf_kprobe_multi_link_attach() did not validate whether the
program being attached had the sleepable flag set, allowing sleepable
helpers such as bpf_copy_from_user() to be invoked from a non-sleepable
context.

This causes a "sleeping function called from invalid context" splat:

  BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169
  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1787, name: sudo
  preempt_count: 1, expected: 0
  RCU nest depth: 2, expected: 0

Fix this by rejecting sleepable programs early in
bpf_kprobe_multi_link_attach(), before any further processing.

Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Leon Hwang <leon.hwang@linux.dev>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20260401191126.440683-1-varunrmallya@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
[shung-hsi.yu: sleepable flag was in 'struct bpf_prog_aux' before commit
66c8473135c6 "bpf: move sleepable flag from bpf_prog_aux to bpf_prog"]
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
---
Checked that test_verifier and all flavors of test_progs in BPF
selftests still passes on x86_64 with the patchset applied[1].

1: https://github.com/kernel-patches/linux-stable/actions/runs/28080168542/job/83133064970
---
 kernel/trace/bpf_trace.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index a896b80252ae..87e7cc2dc5cc 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2905,6 +2905,10 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
 	if (prog->expected_attach_type != BPF_TRACE_KPROBE_MULTI)
 		return -EINVAL;
 
+	/* kprobe_multi is not allowed to be sleepable. */
+	if (prog->aux->sleepable)
+		return -EINVAL;
+
 	flags = attr->link_create.kprobe_multi.flags;
 	if (flags & ~BPF_F_KPROBE_MULTI_RETURN)
 		return -EINVAL;
-- 
2.54.0


^ permalink raw reply related	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2026-06-25 10:42 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-24  7:28 [PATCH stable 6.6 1/2] bpf: Reject sleepable kprobe_multi programs at attach time Shung-Hsi Yu
2026-06-24  7:29 ` [PATCH stable 6.6 2/2] selftests/bpf: Add test to ensure kprobe_multi is not sleepable Shung-Hsi Yu
2026-06-25 10:41 ` [PATCH stable 6.6 1/2] bpf: Reject sleepable kprobe_multi programs at attach time Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox