Re: [PATCH bpf v5 3/3] selftests/bpf: Detach a trampoline prog while a task sleeps before it

[sashiko-bot@kernel.org]

> Add a test for the use-after-free fixed by the previous commit. A
> sleepable prog on bpf_fentry_test1() blocks a task on a userfaultfd
> page, like bpf_mod_race does, while the two progs that run after it in
> the same trampoline are detached and freed one after the other, which
> the test knows from their .bss maps going away. After the first detach
> the task is in an image that isn't the trampoline's current one
> anymore. The task is then released and must not call into the freed
> progs. This is done with fentry progs, with fexit progs, where the task
> is already past the original function, and with a task sleeping in a
> fentry prog while fexit progs are detached, where the original function
> must still be called. bpf_mod_race's userfaultfd helper moves to
> testing_helpers.c so that both tests can use it.
> 
> Without the fix, on a kernel with KASAN:
> 
>   BUG: KASAN: vmalloc-out-of-bounds in __bpf_prog_enter_recur+0xed/0x1e0
>   Read of size 8 at addr ffa0000000144040 by task test_progs/171
>   CPU: 6 UID: 0 PID: 171 Comm: test_progs Tainted: G           OE       7.2.0+ #1 PREEMPT(full)
>   Call Trace:
>    <TASK>
>    __bpf_prog_enter_recur+0xed/0x1e0
>    bpf_trampoline_6442545468+0x72/0xe3
>    bpf_fentry_test1+0x9/0x20
>    bpf_prog_test_run_tracing+0x183/0x3e0
>    __sys_bpf+0xd3f/0x38f0
>    ...
> 
> Assisted-by: Claude:unspecified
> Signed-off-by: Florent Revest (Anthropic) <florent.revest@linux.dev>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926135605.1217928-1-florent.revest@linux.dev?part=3