Re: [PATCH bpf-next v2] bpf: Log error code on trampoline unlink failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free due to flawed teardown design when bpf_trampoline_unlink_prog fails
--

--- Patch [1]: [PATCH bpf-next v2] bpf: Log error code on trampoline unlink failure ---
commit 8f743682724c96c3eba346cdcf6a1a3646dc28bd
Author: xu xin <xu.xin16@zte.com.cn>

bpf: Log error code on trampoline unlink failure

Replace silent WARN_ON_ONCE with WARN_ONCE that prints the actual error
code from bpf_trampoline_unlink_prog(). This aids debugging of race
conditions during link teardown.

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 0ff9e3aa293d5..9cbe00bc8d051 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3547,10 +3547,13 @@ static void bpf_tracing_link_release(struct bpf_link *link)
>  {
>  	struct bpf_tracing_link *tr_link =
>  		container_of(link, struct bpf_tracing_link, link.link);
> +	int err;
>  
> -	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link.node,
> -						tr_link->trampoline,
> -						tr_link->tgt_prog));
> +	err = bpf_trampoline_unlink_prog(&tr_link->link.node,
> +					tr_link->trampoline,
> +					tr_link->tgt_prog);
> +	if (err)
> +		WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);

[Severity: High]
This isn't a bug introduced by this patch, but does this error path lead to a
Use-After-Free?

If bpf_trampoline_unlink_prog() fails (for example, due to a memory allocation
failure in bpf_tramp_image_alloc() during bpf_trampoline_update()), the caller
logs the error here but continues the teardown process.

Because the update failed, the old active trampoline image remains registered 
with ftrace or direct calls. However, the link teardown will unconditionally 
free the linked BPF program:

kernel/bpf/syscall.c:bpf_link_dealloc() {
    ...
    if (link->prog)
        bpf_prog_put(link->prog);
    ...
}

Furthermore, bpf_trampoline_put() might also free the trampoline itself while
ftrace is still calling it. This happens because the program was eagerly
removed from the hlist before the update failed, allowing the emptiness check
to pass:

kernel/bpf/trampoline.c:bpf_trampoline_put() {
    ...
    for (i = 0; i < BPF_TRAMP_MAX; i++)
        if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[i])))
            goto out;
    ...
    direct_ops_free(tr);
    kfree(tr);
}

Can a subsequent ftrace invocation hit the freed trampoline or execute the
freed BPF program and cause a crash?

>  
>  	bpf_trampoline_put(tr_link->trampoline);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260726230724742Z4CDN9ntFInEofAf2YxME@zte.com.cn?part=1