[PATCH bpf-next v2 0/2] bpf: Fix bpf_send_signal_task() from kernel thread context

[PATCH bpf-next v2 0/2] bpf: Fix bpf_send_signal_task() from kernel thread context

[Aditya Sharma]

bpf_send_signal_task() returns -EPERM whenever the calling context is a
kernel thread, even when the signal is for a different task. The
cause is the nmi_uaccess_okay() check in bpf_send_signal_common(),
which is a statement about current and not about the target task.

Patch 1 removes the check, as the signal path does no user memory
access and the check has nothing to guard there.

Patch 2 adds a selftest that sends a signal to a user task from
tp_btf/workqueue_execute_start, where current is always a kworker.
Without patch 1, this test fails on x86.

v1 -> v2:
- Rebase onto current bpf-next.
- Add this cover letter (v1 was sent without one)
- Remove nmi_uaccess_okay() check (as per Andrii)
- Fixed a stale comment above checks in bpf_send_signal_common()
- Gate send_signal_kworker on a new kworker_test global that only this
  test sets. (Sashiko AI review)
- Put /* of a multi line comment on its own line (Sashiko AI review)

v1: https://lore.kernel.org/bpf/20260902150439.692725-1-adi.sharma@zohomail.in/

Aditya Sharma (2):
  bpf: Remove nmi_uaccess_okay() check in bpf_send_signal_common()
  selftests/bpf: Test bpf_send_signal_task() from kernel thread context

 kernel/trace/bpf_trace.c                      |   9 +-
 .../selftests/bpf/prog_tests/send_signal.c    | 106 ++++++++++++++++++
 .../bpf/progs/test_send_signal_kern.c         |  29 +++++
 3 files changed, 138 insertions(+), 6 deletions(-)


base-commit: 61c1e63c9b651a77b1e24208b9361965c69959e6
-- 
2.34.1

[PATCH bpf-next v2 1/2] bpf: Remove nmi_uaccess_okay() check in bpf_send_signal_common()

[Aditya Sharma]

nmi_uaccess_okay() takes no task argument and is a statement about
current. When commit 6280cf718db0 ("bpf: Implement bpf_send_signal_task()
kfunc") made the PF_KTHREAD/PF_EXITING and is_global_init() test the
supplied task, nmi_uaccess_okay() was left testing current.

As a result bpf_send_signal_task() returns -EPERM whenever the
calling context happens to be a kernel thread, regardless of which task
the signal is aimed at. The same call with the same target succeeds or
fails depending only on what the CPU was running:

  bpf_send_signal_task() from tp_btf/workqueue_execute_start : -EPERM
  bpf_send_signal_task() from tp_btf/sys_enter               : 0

The check was carried over from bpf_probe_write_user() when
bpf_send_signal() was added in commit 8b401f9ed244 ("bpf: implement
bpf_send_signal() helper"). There it guards a user memory write, but
bpf_send_signal_common() does no user memory access, so the check has
nothing to guard here. It is also already a no-op outside x86.

Remove it, and drop the part of the comment above it that described
the memory access checks, as none remain.

Fixes: 6280cf718db0 ("bpf: Implement bpf_send_signal_task() kfunc")
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260819124324.43162-1-adi.sharma@zohomail.in/T/#u
Signed-off-by: Aditya Sharma <adi.sharma@zohomail.in>
---
 kernel/trace/bpf_trace.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 195f78db9bda..f6e335a37a91 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -864,15 +864,12 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type, struct task_struc
 		siginfo = &info;
 	}
 
-	/* Similar to bpf_probe_write_user, task needs to be
-	 * in a sound condition and kernel memory access be
-	 * permitted in order to send signal to the current
-	 * task.
+	/*
+	 * Similar to bpf_probe_write_user, task needs to be
+	 * in a sound condition.
 	 */
 	if (unlikely(task->flags & (PF_KTHREAD | PF_EXITING)))
 		return -EPERM;
-	if (unlikely(!nmi_uaccess_okay()))
-		return -EPERM;
 	/* Task should not be pid=1 to avoid kernel panic. */
 	if (unlikely(is_global_init(task)))
 		return -EPERM;
-- 
2.34.1

[PATCH bpf-next v2 2/2] selftests/bpf: Test bpf_send_signal_task() from kernel thread context

[Aditya Sharma]

The existing send_signal tests, including the _remote variants that
exercise bpf_send_signal_task() with a caller-supplied target, all
gate on

  if ((bpf_get_current_pid_tgid() >> 32) == pid)

so the BPF program only ever runs while current is the test process.
The caller-context dimension is therefore untested, which is how
bpf_send_signal_task() failing from kernel thread context went
unnoticed.

Add a program attached to tp_btf/workqueue_execute_start, where
current is always a kworker. It cannot filter on current, so it is
driven by target_pid and gated on a kworker_test flag that only this
test sets, and the test asserts the child receives the signal.
Setting pid to 0 leaves the pre-existing programs in the skeleton
inert. Workqueues run on their own, so nothing has to be triggered
from userspace.

Without removing the nmi_uaccess_okay() check, this test fails on x86.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Aditya Sharma <adi.sharma@zohomail.in>
---
 .../selftests/bpf/prog_tests/send_signal.c    | 106 ++++++++++++++++++
 .../bpf/progs/test_send_signal_kern.c         |  29 +++++
 2 files changed, 135 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/send_signal.c b/tools/testing/selftests/bpf/prog_tests/send_signal.c
index 7ac4d5a488aa..ecec2ee8b19a 100644
--- a/tools/testing/selftests/bpf/prog_tests/send_signal.c
+++ b/tools/testing/selftests/bpf/prog_tests/send_signal.c
@@ -261,6 +261,110 @@ static void test_send_signal_nmi(bool signal_thread, bool remote)
 	test_send_signal_common(&attr, signal_thread, remote);
 }
 
+static void test_send_signal_kworker(void)
+{
+	struct test_send_signal_kern *skel;
+	int pipe_c2p[2], pipe_p2c[2];
+	struct sigaction sa = {};
+	char buf[256];
+	int err = -1;
+	pid_t pid;
+
+	if (!ASSERT_OK(pipe(pipe_c2p), "pipe_c2p"))
+		return;
+
+	if (!ASSERT_OK(pipe(pipe_p2c), "pipe_p2c")) {
+		close(pipe_c2p[0]);
+		close(pipe_c2p[1]);
+		return;
+	}
+
+	pid = fork();
+	if (!ASSERT_GE(pid, 0, "fork")) {
+		close(pipe_c2p[0]);
+		close(pipe_c2p[1]);
+		close(pipe_p2c[0]);
+		close(pipe_p2c[1]);
+		return;
+	}
+
+	if (pid == 0) {
+		/* install signal handler and notify parent */
+		sa.sa_sigaction = sigusr1_siginfo_handler;
+		sa.sa_flags = SA_RESTART | SA_SIGINFO;
+		ASSERT_NEQ(sigaction(SIGUSR1, &sa, NULL), -1, "sigaction");
+
+		close(pipe_c2p[0]); /* close read */
+		close(pipe_p2c[1]); /* close write */
+
+		/* notify parent signal handler is installed */
+		ASSERT_EQ(write(pipe_c2p[1], buf, 1), 1, "pipe_write");
+
+		/* make sure parent enabled bpf program to send_signal */
+		ASSERT_EQ(read(pipe_p2c[0], buf, 1), 1, "pipe_read");
+
+		/*
+		 * The signal is sent from workqueue context, so nothing has
+		 * to be triggered from here.
+		 */
+		while (!sigusr1_received)
+			sleep(1);
+
+		buf[0] = sigusr1_received;
+
+		ASSERT_EQ(sigusr1_received, 8, "sigusr1_received");
+		ASSERT_EQ(write(pipe_c2p[1], buf, 1), 1, "pipe_write");
+
+		close(pipe_c2p[1]);
+		close(pipe_p2c[0]);
+		exit(0);
+	}
+
+	close(pipe_c2p[1]); /* close write */
+	close(pipe_p2c[0]); /* close read */
+
+	skel = test_send_signal_kern__open_and_load();
+	if (!ASSERT_OK_PTR(skel, "skel_open_and_load"))
+		goto skel_open_load_failure;
+
+	/* wait until child signal handler installed */
+	ASSERT_EQ(read(pipe_c2p[0], buf, 1), 1, "pipe_read");
+
+	/* pid == 0 keeps the other programs of this skeleton inactive */
+	skel->bss->kworker_test = 1;
+	skel->bss->pid = 0;
+	skel->bss->sig = SIGUSR1;
+	skel->bss->target_pid = pid;
+
+	err = test_send_signal_kern__attach(skel);
+	if (!ASSERT_OK(err, "skel_attach")) {
+		err = -1;
+		goto destroy_skel;
+	}
+
+	/* notify child that bpf program can send_signal now */
+	ASSERT_EQ(write(pipe_p2c[1], buf, 1), 1, "pipe_write");
+
+	/* wait for result, workqueues run on their own */
+	err = read_with_timeout(pipe_c2p[0], buf, 1, 10 * 1000 * 1000);
+	if (!ASSERT_GT(err, 0, "reading pipe"))
+		goto destroy_skel;
+
+	ASSERT_EQ(buf[0], 8, "incorrect result");
+
+destroy_skel:
+	test_send_signal_kern__destroy(skel);
+skel_open_load_failure:
+	close(pipe_c2p[0]);
+	close(pipe_p2c[1]);
+	/*
+	 * Child is either about to exit cleanly or stuck in case of errors.
+	 * Nudge it to exit.
+	 */
+	kill(pid, SIGKILL);
+	wait(NULL);
+}
+
 void test_send_signal(void)
 {
 	if (test__start_subtest("send_signal_tracepoint"))
@@ -289,4 +393,6 @@ void test_send_signal(void)
 		test_send_signal_perf(true, true);
 	if (test__start_subtest("send_signal_nmi_thread_remote"))
 		test_send_signal_nmi(true, true);
+	if (test__start_subtest("send_signal_kworker"))
+		test_send_signal_kworker();
 }
diff --git a/tools/testing/selftests/bpf/progs/test_send_signal_kern.c b/tools/testing/selftests/bpf/progs/test_send_signal_kern.c
index 176a355e3062..f9c4496d9fe1 100644
--- a/tools/testing/selftests/bpf/progs/test_send_signal_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_send_signal_kern.c
@@ -9,6 +9,7 @@ void bpf_task_release(struct task_struct *p) __ksym;
 int bpf_send_signal_task(struct task_struct *task, int sig, enum pid_type type, u64 value) __ksym;
 
 __u32 sig = 0, pid = 0, status = 0, signal_thread = 0, target_pid = 0;
+__u32 kworker_test = 0;
 
 static __always_inline int bpf_send_signal_test(void *ctx)
 {
@@ -60,6 +61,34 @@ int send_signal_tp_sched(void *ctx)
 	return bpf_send_signal_test(ctx);
 }
 
+/*
+ * Send a signal to a task other than current, from a context where current
+ * is a kernel thread. No filtering on current is possible here, so this is
+ * driven by target_pid, and gated on kworker_test so that it stays inactive
+ * in the other tests.
+ */
+SEC("tp_btf/workqueue_execute_start")
+int send_signal_kworker(void *ctx)
+{
+	struct task_struct *target_task;
+	int ret;
+
+	if (status != 0 || !kworker_test || target_pid == 0)
+		return 0;
+
+	target_task = bpf_task_from_pid(target_pid);
+	if (!target_task)
+		return 0;
+
+	ret = bpf_send_signal_task(target_task, sig, PIDTYPE_TGID, 8);
+	bpf_task_release(target_task);
+
+	if (ret == 0)
+		status = 1;
+
+	return 0;
+}
+
 SEC("perf_event")
 int send_signal_perf(void *ctx)
 {
-- 
2.34.1

Re: [PATCH bpf-next v2 0/2] bpf: Fix bpf_send_signal_task() from kernel thread context

[Aditya Sharma]

Hi,


Gentle ping on this series.

Andrii - patch 1 now removes the nmi_uaccess_okay() check entirely, as
suggested on v1. Is this what you had in mind, or should I change
something?

Thanks,
Aditya

Re: [PATCH bpf-next v2 0/2] bpf: Fix bpf_send_signal_task() from kernel thread context

[Andrii Nakryiko]

On Fri, Oct 23, 2026 at 5:46 AM Aditya Sharma <adi.sharma@zohomail.in> wrote:
>
> Hi,
>
>
> Gentle ping on this series.
>
> Andrii - patch 1 now removes the nmi_uaccess_okay() check entirely, as
> suggested on v1. Is this what you had in mind, or should I change
> something?
>

Hi, yes, it looks good to me, sorry it fell off the radar. bpf-next is
closed right now so I can't apply this just yet, but I'll apply one we
can do that

> Thanks,
> Aditya

Re: [PATCH bpf-next v2 0/2] bpf: Fix bpf_send_signal_task() from kernel thread context

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Thu,  1 Oct 2026 12:54:47 +0530 you wrote:
> bpf_send_signal_task() returns -EPERM whenever the calling context is a
> kernel thread, even when the signal is for a different task. The
> cause is the nmi_uaccess_okay() check in bpf_send_signal_common(),
> which is a statement about current and not about the target task.
> 
> Patch 1 removes the check, as the signal path does no user memory
> access and the check has nothing to guard there.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v2,1/2] bpf: Remove nmi_uaccess_okay() check in bpf_send_signal_common()
    https://git.kernel.org/bpf/bpf/c/93bd472336ac
  - [bpf-next,v2,2/2] selftests/bpf: Test bpf_send_signal_task() from kernel thread context
    https://git.kernel.org/bpf/bpf/c/2c79610f72bb

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html