CVE-2026-74338: bpf: Reject sleepable BPF_LSM_CGROUP programs at load time

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject sleepable BPFLSMCGROUP programs at load time

The cgroup shim runs under rcureadlockdontmigrate(), so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to load sleepable BPF programs destined for LSM cgroup attachment.

Without this, we get the following splat from a BPFLSMCGROUP program marked BPFFSLEEPABLE attached to fileopen when it calls bpfgetdentryxattr():

BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1567 inatomic(): 0, irqsdisabled(): 0, nonblock: 0, pid: 34317, name: load preemptcount: 0, expected: 0 RCU nest depth: 2, expected: 0 Call Trace: downread+0x76/0x480 ext4xattrget+0x11f/0x700 vfsgetxattr+0xf0/0x150 bpfgetdentryxattr+0xbb/0xf0 bpfproge76a298dac9218c6testopen+0x6a/0x85 cgroupbpfrunlsmcurrent+0x326/0x840 bpftrampoline6442534646+0x62/0x14d securityfileopen+0x34/0x60 dodentryopen+0x340/0x1260 vfsopen+0x7a/0x440 pathopenat+0x1bac/0x30a0

libbpf provides a .s named section variant for every sleepable program type except lsmcgroup, reflecting that per-cgroup LSM programs are intended to only run in a non-sleepable context.

The above splat was obtained by bypassing libbpf by using bpf(2) directly.