bpf: Consolidate sleepable checks in check_kfunc_call()

check_kfunc_call() has multiple scattered checks that reject sleepable
kfuncs in various non-sleepable contexts (RCU, preempt-disabled, IRQ-
disabled). These are the same conditions already checked by
in_sleepable_context(), so replace them with a single consolidated
check.

This also simplifies the preempt lock tracking by flattening the nested
if/else structure into a linear chain: preempt_disable increments,
preempt_enable checks for underflow and decrements. The sleepable check
is kept as a separate block since it is logically distinct from the lock
accounting.

No functional change since in_sleepable_context() checks all the same
state (active_rcu_locks, active_preempt_locks, active_locks,
active_irq_id, in_sleepable).

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260318174327.3151925-3-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 4e0f6be5d2d59ebfb33f883b0f081e1ee39d220e..a9130c4888f7092fbbb909d12e09bad6ee662d07 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -14276,34 +14276,24 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
                                }
                        }));
                }
-       } else if (sleepable && env->cur_state->active_rcu_locks) {
-               verbose(env, "kernel func %s is sleepable within rcu_read_lock region\n", func_name);
-               return -EACCES;
-       }
-
-       if (in_rbtree_lock_required_cb(env) && (rcu_lock || rcu_unlock)) {
-               verbose(env, "Calling bpf_rcu_read_{lock,unlock} in unnecessary rbtree callback\n");
-               return -EACCES;
-       }
-
-       if (env->cur_state->active_preempt_locks) {
-               if (preempt_disable) {
-                       env->cur_state->active_preempt_locks++;
-               } else if (preempt_enable) {
-                       env->cur_state->active_preempt_locks--;
-               } else if (sleepable) {
-                       verbose(env, "kernel func %s is sleepable within non-preemptible region\n", func_name);
-                       return -EACCES;
-               }
        } else if (preempt_disable) {
                env->cur_state->active_preempt_locks++;
        } else if (preempt_enable) {
-               verbose(env, "unmatched attempt to enable preemption (kernel function %s)\n", func_name);
-               return -EINVAL;
+               if (env->cur_state->active_preempt_locks == 0) {
+                       verbose(env, "unmatched attempt to enable preemption (kernel function %s)\n", func_name);
+                       return -EINVAL;
+               }
+               env->cur_state->active_preempt_locks--;
        }
 
-       if (env->cur_state->active_irq_id && sleepable) {
-               verbose(env, "kernel func %s is sleepable within IRQ-disabled region\n", func_name);
+       if (sleepable && !in_sleepable_context(env)) {
+               verbose(env, "kernel func %s is sleepable within %s\n",
+                       func_name, non_sleepable_context_description(env));
+               return -EACCES;
+       }
+
+       if (in_rbtree_lock_required_cb(env) && (rcu_lock || rcu_unlock)) {
+               verbose(env, "Calling bpf_rcu_read_{lock,unlock} in unnecessary rbtree callback\n");
                return -EACCES;
        }