From nobody Fri Jul 24 21:27:13 2026 Received: from out-188.mta0.migadu.com (out-188.mta0.migadu.com [91.218.175.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E54883E9C1C for ; Fri, 24 Jul 2026 14:14:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784902489; cv=none; b=isBHj1y6SeyZggPB3TPmhaoD5G1dGutKuqfHuGXiVuvD43sWjARWrcum/t7j/v0f7MYuoOlGS6YfL6C2ewNFI06wsI3ijh0qFPu+OQRfFSP0B0laZMx5dSfnR+u0AbNKo+lJiS0DpeBYc17oprsIenefMjExKwkFjESmYkEnz6c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784902489; c=relaxed/simple; bh=JCpz07QMIoYkgWlFbFkBXaMEQIeBpd6j7HAefVsL008=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ho6n9Qp1YuAoPQ2eMNTokk72U10T3XNjQwmPS5fO+xW3UnopcngphZLTUWvdNKiQ2E8GzyIJvCkiNQMXzL0p8VZPnzcX0NjBmalBUgynOdV2RYsPyhosN4eqTDsIadPH4WoIc0QaaTxyxzGccykxkytctoPQZcKapIBDxAzkHP8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=SHacB/p3; arc=none smtp.client-ip=91.218.175.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="SHacB/p3" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1784902485; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CtBv+6DKpRgeUFFG4TgzRtR+eRItYzi9T1OzkhCupJw=; b=SHacB/p335Ksp6x94cwKEounO35MYO6UNiaadteJdmJOK6XBUmunYbgvq4+bGzeEpwrNVB 7PCRRvldTxswTNOa3q/yVHZzGJtUvVMZHmb1mTKQlQBxz5DTsQd1KBmICwG8s4YKiqgJDO MOBCyETxKzHxS2a4pTie5MnPmZceY94= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , Shuah Khan , Sechang Lim , Varun R Mallya , Leon Hwang , Viktor Malik , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH bpf-next 1/2] bpf: Fix sleepable check for tracing prog Date: Fri, 24 Jul 2026 22:14:21 +0800 Message-ID: <20260724141422.10463-2-leon.hwang@linux.dev> In-Reply-To: <20260724141422.10463-1-leon.hwang@linux.dev> References: <20260724141422.10463-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" When CONFIG_FUNCTION_ERROR_INJECTION is disabled, a sleepable tracing prog is allowed to attach to '__x64_'-alike prefix symbols. It is because the verifier does not verify whether the symbol is a kernel function or a bpf prog. That said, a sleepable tracing prog is allowed to attach to a bpf prog target whose name has '__x64_'-alike prefix. For example, a sleepable fentry prog attaches to a '__x64_sys_nop' XDP prog, and copies buffer from a user pointer with bpf_copy_from_user() helper. After attaching the XDP prog to lo interface, the kernel BUG could be triggered by 'ping -c 1 -W 1 127.0.0.1': [ 3.460756] BUG: sleeping function called from invalid context at kernel= /bpf/trampoline.c:1324 Fix it by disallowing sleepable tracing prog always when its target is bpf prog. Fixes: 16d9c5660692 ("bpf: Always allow sleepable programs on syscalls") Signed-off-by: Leon Hwang Acked-by: Viktor Malik --- kernel/bpf/verifier.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 52be0a118cce..40d567b90d24 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -18935,13 +18935,16 @@ static bool is_tracing_multi_id(const struct bpf_= prog *prog, u32 btf_id) } =20 static int btf_id_allow_sleepable(u32 btf_id, unsigned long addr, const st= ruct bpf_prog *prog, - const struct btf *btf) + const struct btf *btf, const struct bpf_prog *tgt_prog) { const struct btf_type *t; const char *tname; =20 switch (prog->type) { case BPF_PROG_TYPE_TRACING: + if (tgt_prog) + return prog->sleepable ? -EINVAL : 0; + t =3D btf_type_by_id(btf, btf_id); if (!t) return -EINVAL; @@ -19324,7 +19327,7 @@ int bpf_check_attach_target(struct bpf_verifier_log= *log, } =20 if (prog->sleepable) { - ret =3D btf_id_allow_sleepable(btf_id, addr, prog, btf); + ret =3D btf_id_allow_sleepable(btf_id, addr, prog, btf, tgt_prog); if (ret) { module_put(mod); bpf_log(log, "%s is not sleepable\n", tname); @@ -19575,7 +19578,7 @@ int bpf_check_attach_btf_id_multi(struct btf *btf, = struct bpf_prog *prog, u32 bt =20 /* Check sleepable program attachment. */ if (prog->sleepable) { - err =3D btf_id_allow_sleepable(btf_id, addr, prog, btf); + err =3D btf_id_allow_sleepable(btf_id, addr, prog, btf, NULL); if (err) return err; } --=20 2.55.0 From nobody Fri Jul 24 21:27:13 2026 Received: from out-181.mta0.migadu.com (out-181.mta0.migadu.com [91.218.175.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C808C419FB0; Fri, 24 Jul 2026 14:15:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784902506; cv=none; b=k0ZED5N80bZUTDQ+Vt6bjV3ZVHKxJtx4Zv3SQ8+88TbsMV7KcUvdgxUqFOjJXwYd6m+lzQQlGOrUTYt8PupLxjHv1V0/JRHmsjlTS7j3kjsYwcrUOs8AbKECxRYs3T6m5hd57NTzw7fyE+c6fxyF7UfJu+RZ5b+9qwVTxD+3Ioo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784902506; c=relaxed/simple; bh=ka//KcHbyYQUh2bSJY7Nt4kXw73ZHvokyQ/vwGI/Sds=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dCIRqyoxGT945gcSWRDcT1LM9uwrtwkrfl5eVipuzjrCorwu94fw0+kV4lOJCApisuqQycU6QukdoS/JShPrznbjqy0VuIgghq6o9/nn1yKMymLEhwSlKSqkgS4xfkVLsPflZBR1wi0rZ8pFmJOF6Tvx63UlweMGEZz77jA0BHI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=T5ywUL+Q; arc=none smtp.client-ip=91.218.175.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="T5ywUL+Q" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1784902497; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=20vkqGm/nP+8NBvcX1R/kUQUl8YlGe7JJv6AylUO3fo=; b=T5ywUL+QyVm0f06YCQfQtOIBZZtyqLRkD2cPvVyoZxRjLDe2621vek50uKmMxHqRbrcftW 3uMbaZ1YoO2PrMiKo51kLNxitaQ7DjQ5Qw69WIYlaH1eVBmfmNxayfzjlIMY42SrPTCGJ/ E+qwpXLL+/Blg3PmzocQNsUh4itDK+8= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , Shuah Khan , Sechang Lim , Varun R Mallya , Leon Hwang , Viktor Malik , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH bpf-next 2/2] selftests/bpf: Verify rejection of sleepable tracing prog Date: Fri, 24 Jul 2026 22:14:22 +0800 Message-ID: <20260724141422.10463-3-leon.hwang@linux.dev> In-Reply-To: <20260724141422.10463-1-leon.hwang@linux.dev> References: <20260724141422.10463-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Add a test to verify that the sleepable tracing prog cannot attach to a '__x64_sys' prefix prog target. When CONFIG_FUNCTION_ERROR_INJECTION is disabled, without the fix, the test would trigger the BUG: [ 3.460756] BUG: sleeping function called from invalid context at kernel= /bpf/trampoline.c:1324 Signed-off-by: Leon Hwang --- .../selftests/bpf/prog_tests/fexit_bpf2bpf.c | 57 +++++++++++++++++++ .../selftests/bpf/progs/fentry_sleepable.c | 19 +++++++ tools/testing/selftests/bpf/progs/xdp_dummy.c | 6 ++ 3 files changed, 82 insertions(+) create mode 100644 tools/testing/selftests/bpf/progs/fentry_sleepable.c diff --git a/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c b/tools= /testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c index 4a87d7163c8c..2523c07a16c6 100644 --- a/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c +++ b/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c @@ -5,6 +5,7 @@ #include #include "bind4_prog.skel.h" #include "freplace_progmap.skel.h" +#include "fentry_sleepable.skel.h" #include "xdp_dummy.skel.h" =20 typedef int (*test_cb)(struct bpf_object *obj); @@ -576,6 +577,60 @@ static void test_func_replace_progmap(void) freplace_progmap__destroy(skel); } =20 +static void test_sleepable_fentry_to_xdp(void) +{ + struct fentry_sleepable *skel =3D NULL; + struct xdp_dummy *skel_xdp =3D NULL; + int ifindex, prog_fd, err; + char buff[64] =3D {}; + +#ifndef __x86_64__ + test__skip(); + return; +#endif + + ifindex =3D if_nametoindex("lo"); + if (!ASSERT_GT(ifindex, 0, "if_nametoindex")) + return; + + skel_xdp =3D xdp_dummy__open_and_load(); + if (!ASSERT_OK_PTR(skel_xdp, "xdp_dummy__open_and_load")) + return; + + skel =3D fentry_sleepable__open(); + if (!ASSERT_OK_PTR(skel, "fentry_sleepable__open")) + goto out; + + skel->bss->user_ptr =3D buff; + + prog_fd =3D bpf_program__fd(skel_xdp->progs.__x64_sys_nop); + err =3D bpf_program__set_attach_target(skel->progs.fentry_xdp, prog_fd, "= __x64_sys_nop"); + if (!ASSERT_OK(err, "bpf_program__set_attach_target")) + goto out; + + err =3D fentry_sleepable__load(skel); + ASSERT_ERR(err, "fentry_sleepable__load"); + if (err) + goto out; + + skel->links.fentry_xdp =3D bpf_program__attach_trace(skel->progs.fentry_x= dp); + if (!ASSERT_OK_PTR(skel->links.fentry_xdp, "bpf_program__attach_trace")) + goto out; + + skel_xdp->links.__x64_sys_nop =3D bpf_program__attach_xdp(skel_xdp->progs= .__x64_sys_nop, + ifindex); + if (!ASSERT_OK_PTR(skel_xdp->links.__x64_sys_nop, "bpf_program__attach_xd= p")) + goto out; + + err =3D system("ping -q -c 1 -W 1 127.0.0.1 > /dev/null"); + ASSERT_OK(err, "ping"); + ASSERT_ERR(skel->bss->retval, "retval"); + +out: + fentry_sleepable__destroy(skel); + xdp_dummy__destroy(skel_xdp); +} + /* NOTE: affect other tests, must run in serial mode */ void serial_test_fexit_bpf2bpf(void) { @@ -607,4 +662,6 @@ void serial_test_fexit_bpf2bpf(void) test_func_replace_int_with_void(); if (test__start_subtest("freplace_void")) test_func_replace_void(); + if (test__start_subtest("sleepable_fentry_to_xdp")) + test_sleepable_fentry_to_xdp(); } diff --git a/tools/testing/selftests/bpf/progs/fentry_sleepable.c b/tools/t= esting/selftests/bpf/progs/fentry_sleepable.c new file mode 100644 index 000000000000..44b938f485e2 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/fentry_sleepable.c @@ -0,0 +1,19 @@ +// SPDX-License-Identifier: GPL-2.0 +#include "vmlinux.h" +#include +#include + +char LICENSE[] SEC("license") =3D "GPL"; + +void *user_ptr; +int retval; + +SEC("fentry.s") +int BPF_PROG(fentry_xdp) +{ + char buff[64]; + + retval =3D bpf_copy_from_user(buff, sizeof(buff), user_ptr); + return 0; +} + diff --git a/tools/testing/selftests/bpf/progs/xdp_dummy.c b/tools/testing/= selftests/bpf/progs/xdp_dummy.c index d988b2e0cee8..5f1e0771021d 100644 --- a/tools/testing/selftests/bpf/progs/xdp_dummy.c +++ b/tools/testing/selftests/bpf/progs/xdp_dummy.c @@ -10,4 +10,10 @@ int xdp_dummy_prog(struct xdp_md *ctx) return XDP_PASS; } =20 +SEC("xdp") +int __x64_sys_nop(struct xdp_md *ctx) +{ + return XDP_PASS; +} + char _license[] SEC("license") =3D "GPL"; --=20 2.55.0