From 93bd472336ac2424f5f3cf05cbb24e02242343b7 Mon Sep 17 00:00:00 2001 From: Aditya Sharma Date: Thu, 1 Oct 2026 12:54:48 +0530 Subject: [PATCH] bpf: Remove nmi_uaccess_okay() check in bpf_send_signal_common() nmi_uaccess_okay() takes no task argument and is a statement about current. When commit 6280cf718db0 ("bpf: Implement bpf_send_signal_task() kfunc") made the PF_KTHREAD/PF_EXITING and is_global_init() test the supplied task, nmi_uaccess_okay() was left testing current. As a result bpf_send_signal_task() returns -EPERM whenever the calling context happens to be a kernel thread, regardless of which task the signal is aimed at. The same call with the same target succeeds or fails depending only on what the CPU was running: bpf_send_signal_task() from tp_btf/workqueue_execute_start : -EPERM bpf_send_signal_task() from tp_btf/sys_enter : 0 The check was carried over from bpf_probe_write_user() when bpf_send_signal() was added in commit 8b401f9ed244 ("bpf: implement bpf_send_signal() helper"). There it guards a user memory write, but bpf_send_signal_common() does no user memory access, so the check has nothing to guard here. It is also already a no-op outside x86. Remove it, and drop the part of the comment above it that described the memory access checks, as none remain. Fixes: 6280cf718db0 ("bpf: Implement bpf_send_signal_task() kfunc") Suggested-by: Andrii Nakryiko Signed-off-by: Aditya Sharma Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20260819124324.43162-1-adi.sharma@zohomail.in/T/#u Link: https://patch.msgid.link/20261001072449.1377267-2-adi.sharma@zohomail.in --- kernel/trace/bpf_trace.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index dfac5e1b8f40..14adfb85fdb2 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -867,15 +867,12 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type, struct task_struc siginfo = &info; } - /* Similar to bpf_probe_write_user, task needs to be - * in a sound condition and kernel memory access be - * permitted in order to send signal to the current - * task. + /* + * Similar to bpf_probe_write_user, task needs to be + * in a sound condition. */ if (unlikely(task->flags & (PF_KTHREAD | PF_EXITING))) return -EPERM; - if (unlikely(!nmi_uaccess_okay())) - return -EPERM; /* Task should not be pid=1 to avoid kernel panic. */ if (unlikely(is_global_init(task))) return -EPERM;