From nobody Fri Jul 24 21:29:56 2026 Received: from mail-oa1-f49.google.com (mail-oa1-f49.google.com [209.85.160.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB80E42D75B for ; Fri, 24 Jul 2026 15:52:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784908348; cv=none; b=ulBfuTJxm+Z+URVzhjtoQWeVUZ8l6DQNT06WPWl8bPMoJluKrEdW9dzDoJFA44HoHKruYzB+jSePgKd5EJovKmBF/WlU1nyUwZg8fMVSbJ1ZO9PKGxLY/4tsPMybKFVdWLTX2uyueHhiRFO0VZTYLjYyyF3OjD7191cM3HqsXlo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784908348; c=relaxed/simple; bh=0O5lQys1VgtGuCieKlKr8HLQ0rLqc7Hxw88ecJVSu6k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=VK27HGPOKXtDrAdDkJ5G99Gvd9BLwuKA38pPPhw3jP8090Bpgbq0yZBRJOueRuA2WUiWIm5/5lBvwYBEio7DiTzBnUJ6KqyNr/EYw4EdQZFaAZGFknV93WAZ6zOLhlzTt28gaBcIzQQsbS3QR9KCENilk4EZHsEvqkUmeC7qiBI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=hUJOPUvj; arc=none smtp.client-ip=209.85.160.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="hUJOPUvj" Received: by mail-oa1-f49.google.com with SMTP id 586e51a60fabf-45691990234so313481fac.3 for ; Fri, 24 Jul 2026 08:52:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784908342; x=1785513142; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=BBtduID+fBP7XAJrv9Rs1nFoXiwdwwnU4DK8CBqE53E=; b=hUJOPUvjKCDaIz6cEGKJMVx/6TN843ZqX0YykgIq+3Bf8xV7H2GEE8KhhdZHv8HNse +I0E1XZ4tMM0+mRJN3XJ+GAqfikzENllt0o5INTQ2HcFOSQp2k+nLBIdIkxAbllnCktY IqIRnAY+Ly2UxnvCNgLwU/yGMBUTPHt7vJGX7r0yduTxMuCihtnsnBjwAfCJPirBfusO fEx+0AJsTBYDpK1GhebwMBcGFDZl5LFmwQ+4zE9nj+MdO0Vzds5SyGF9Ie38tA/Fhkcc +y+0l98hCntZOdyhEmvO4KWcl+7vr6uqmpjimsCyFqR+kEiyI4jWk0Qrr4qTd6Nocjbx bZTA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784908342; x=1785513142; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=BBtduID+fBP7XAJrv9Rs1nFoXiwdwwnU4DK8CBqE53E=; b=KOvYkPzF9dK3MgZ67fdzlrCDlp9JE9FsfqozTAxjlIe4+pNSCRuJZAhPRCITmaXkNa O4OuwIMyif0XkvGs71QOKwAZKpOzW8u7P0ZvjR22RbuYLf2T2YRp47YeGt7sTlRtReIN Ph3IC3O9KooqYDSdmJ1NG9moZ1ta4DzR1MHvAApHOYdNE4Hfjl/hA3pYrat15z3Hlsdt 2xaPqE28A+xF53iuh0CO14vv9zJi+Kqq2P1d8b4rjW7/gtGT5CAHM7pP7bPRLhhTcTJK aMXbopbOqUjYXUp1QpMwRQNiYWkpFfpWD81KQowwrvPIMZrkf0r0MuCe6/miHdW0ubXj KC/g== X-Forwarded-Encrypted: i=1; AHgh+Ro6JK86IbEsn2CUFxfsXhP7pQQ2tYQAgshq4QXyyWaVn5if7EcjJ2EbqtlN698kPQN/wm/Bf+jqGJ+rGpU=@vger.kernel.org X-Gm-Message-State: AOJu0YyCJsgrqdTnSch0muBuZDxVFlZgXhpUiY6oZI0624oeeEIaStyU zpI7mSYNypzkUCLq3hrl0Az3LiqU68UpeXNXnTGDh4XHPlmOoIFzpXqb X-Gm-Gg: AR+sD12Xwwfz7REAj9UMPRJ//C7uFYSAu73/zcKMRKCKy4HpLUL8Grk+bufO41vvK4W T1mMnVygOW1Z6pOTNgsbeVl5FNZbBIrNyT2jf+EPdZ5dHh9WNIHXcATsQoBQD0JwZGQiiNbokrZ 2Yj+AkQj1MDvAw9/hNJp8uTvzo66UuR/08I/9NcqpUmCThwot9WXY7pl+hV7N9yWqia+Ax1gETS EQYETWfayrJ12Wq8eyjXHWZDvcHrDu9745aviZNGIYtK0Tdw9l/kGiaIrC4TsFViL9V8Qr8HcL1 XgbXAi+oBmw48Zo1YEPBlWA5gA6AzLuxa2beVRjTkj6Y9ksdYMQHMPLXZaM2VYfSt89aJN3pdH1 qifBam8x+h9enctyyGzVCrEmfBEvb9O2LQYAWDbVGbPJxEsm8yPGYG7k+J+e4GPEOsWw= X-Received: by 2002:a05:6808:180b:b0:485:48da:133d with SMTP id 5614622812f47-4ab352f17f4mr4304248b6e.10.1784908342331; Fri, 24 Jul 2026 08:52:22 -0700 (PDT) Received: from localhost ([2a03:2880:30ff:6::]) by smtp.gmail.com with ESMTPSA id 5614622812f47-4ab0f2cb654sm5416433b6e.18.2026.07.24.08.52.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Jul 2026 08:52:22 -0700 (PDT) From: Mykyta Yatsenko Date: Fri, 24 Jul 2026 08:52:06 -0700 Subject: [PATCH bpf-next] bpf: Fix CFI mismatch in task work callback Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260724-task_work_cfi-v1-1-2616691781ed@meta.com> X-B4-Tracking: v=1; b=H4sIACWKY2oC/x3MbQpAQBAG4KtM729bTD5qryJpMcuklnaFkrsrz wGeB0miSoKlB1FOTboFWCoywri4MIvRCZbAOdd5w6U5XFr7a4trP3o11TCVLI59zQ4ZYY/i9f6 /FsPuTZD7QPe+H9eJrQJpAAAA X-Change-ID: 20260724-task_work_cfi-5bd42ea2f62a To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , kernel-team@meta.com, hca@linux.ibm.com Cc: bpf@vger.kernel.org, linux-kernel@vger.kernel.org, Mykyta Yatsenko X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1784908340; l=2205; i=yatsenko@meta.com; s=20260324; h=from:subject:message-id; bh=9kzLGdYv0TkKivlY7UR/RTu6gKjQFFcSuB4plPlM+HM=; b=sj+mH04dK3UyZaAwAeKtHO9sJ51diTtsV/SwWhXGLENQpmxN18WuIuxTG9DNLU/HtRbi1knCZ z3f+VgmNHAzBZbqOUIY1XeHP716sBg83xmZYgBcdZ7a/98Gb4dI03Ke X-Developer-Key: i=yatsenko@meta.com; a=ed25519; pk=1zCUBXUa66KmzfjNsG8YNlMj2ckPdqBPvFq2ww3/YaA= From: Mykyta Yatsenko BPF subprograms use the bpf_callback_t ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpf_callback_t. Fixes: 38aa7003e369 ("bpf: task work scheduling kfuncs") Signed-off-by: Mykyta Yatsenko --- The unpatched task_work selftest triggers a kCFI failure and kernel panic. With this patch, all task_work and task_work_stress subtests pass with CONFIG_CFI=3Dy. --- kernel/bpf/helpers.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index c18f1e16edee..88b38db47de9 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -4388,7 +4388,7 @@ struct bpf_task_work_ctx { struct bpf_map *map; void *map_val; enum task_work_notify_mode mode; - bpf_task_work_callback_t callback_fn; + bpf_callback_t callback_fn; struct rcu_head rcu; } __aligned(8); =20 @@ -4471,7 +4471,8 @@ static void bpf_task_work_callback(struct callback_he= ad *cb) key =3D (void *)map_key_from_value(ctx->map, ctx->map_val, &idx); =20 migrate_disable(); - ctx->callback_fn(ctx->map, key, ctx->map_val); + ctx->callback_fn((u64)(long)ctx->map, (u64)(long)key, + (u64)(long)ctx->map_val, 0, 0); migrate_enable(); =20 bpf_task_work_ctx_reset(ctx); @@ -4594,7 +4595,7 @@ static struct bpf_task_work_ctx *bpf_task_work_acquir= e_ctx(struct bpf_task_work } =20 static int bpf_task_work_schedule(struct task_struct *task, struct bpf_tas= k_work *tw, - struct bpf_map *map, bpf_task_work_callback_t callback_fn, + struct bpf_map *map, void *callback_fn, struct bpf_prog_aux *aux, enum task_work_notify_mode mode) { struct bpf_prog *prog; @@ -4619,7 +4620,7 @@ static int bpf_task_work_schedule(struct task_struct = *task, struct bpf_task_work } =20 ctx->task =3D task; - ctx->callback_fn =3D callback_fn; + ctx->callback_fn =3D (bpf_callback_t)callback_fn; ctx->prog =3D prog; ctx->mode =3D mode; ctx->map =3D map; --- base-commit: c21669db988c8f7cc525198dd33941eec7f092fa change-id: 20260724-task_work_cfi-5bd42ea2f62a Best regards, -- =20 Mykyta Yatsenko