[PATCH bpf-next v2] bpf: Log error code on trampoline unlink failure

[PATCH bpf-next v2] bpf: Log error code on trampoline unlink failure

[xu.xin16]

From: xu xin <xu.xin16@zte.com.cn>

Replace silent WARN_ON_ONCE with WARN_ONCE that prints the actual error
code from bpf_trampoline_unlink_prog(). This aids debugging of race
conditions during link teardown, while keeping the warning rate limited
to avoid log flooding.

This will be very helpful for speeding up trouble-shooting of some crash
UAF due to bpf_trampoline_unlink_prog failures.

No functional change intended.

Signed-off-by: xu xin <xu.xin16@zte.com.cn>
---
v1->v2:
1) clean the subject name by remove 'syscall' suggested by Leon Hwang
https://lore.kernel.org/all/20a444b2-aeed-4af8-ba76-e994e2c14087@linux.dev/
2) Add up the missed case in kernel/bpf/trampoline.c:bpf_shim_tramp_link_release()

kernel/bpf/syscall.c    | 9 ++++++---
 kernel/bpf/trampoline.c | 5 ++++-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 6db306d23b47..2348dc33abf4 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3626,10 +3626,13 @@ static void bpf_tracing_link_release(struct bpf_link *link)
 {
 	struct bpf_tracing_link *tr_link =
 		container_of(link, struct bpf_tracing_link, link.link);
+	int err;

-	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link.node,
-						tr_link->trampoline,
-						tr_link->tgt_prog));
+	err = bpf_trampoline_unlink_prog(&tr_link->link.node,
+					tr_link->trampoline,
+					tr_link->tgt_prog);
+	if (err)
+		WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);

 	bpf_trampoline_put(tr_link->trampoline);

diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index 1a721fc4bef5..dae3c2104ed4 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -997,12 +997,15 @@ static void bpf_shim_tramp_link_release(struct bpf_link *link)
 {
 	struct bpf_shim_tramp_link *shim_link =
 		container_of(link, struct bpf_shim_tramp_link, link.link);
+	int err;

 	/* paired with 'shim_link->trampoline = tr' in bpf_trampoline_link_cgroup_shim */
 	if (!shim_link->trampoline)
 		return;

-	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link.node, shim_link->trampoline, NULL));
+	err = bpf_trampoline_unlink_prog(&shim_link->link.node, shim_link->trampoline, NULL);
+	if (err)
+		WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);
 	bpf_trampoline_put(shim_link->trampoline);
 }

-- 
2.25.1

Re: [PATCH bpf-next v2] bpf: Log error code on trampoline unlink failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free due to flawed teardown design when bpf_trampoline_unlink_prog fails
--

--- Patch [1]: [PATCH bpf-next v2] bpf: Log error code on trampoline unlink failure ---
commit 8f743682724c96c3eba346cdcf6a1a3646dc28bd
Author: xu xin <xu.xin16@zte.com.cn>

bpf: Log error code on trampoline unlink failure

Replace silent WARN_ON_ONCE with WARN_ONCE that prints the actual error
code from bpf_trampoline_unlink_prog(). This aids debugging of race
conditions during link teardown.

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 0ff9e3aa293d5..9cbe00bc8d051 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3547,10 +3547,13 @@ static void bpf_tracing_link_release(struct bpf_link *link)
>  {
>  	struct bpf_tracing_link *tr_link =
>  		container_of(link, struct bpf_tracing_link, link.link);
> +	int err;
>  
> -	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link.node,
> -						tr_link->trampoline,
> -						tr_link->tgt_prog));
> +	err = bpf_trampoline_unlink_prog(&tr_link->link.node,
> +					tr_link->trampoline,
> +					tr_link->tgt_prog);
> +	if (err)
> +		WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);

[Severity: High]
This isn't a bug introduced by this patch, but does this error path lead to a
Use-After-Free?

If bpf_trampoline_unlink_prog() fails (for example, due to a memory allocation
failure in bpf_tramp_image_alloc() during bpf_trampoline_update()), the caller
logs the error here but continues the teardown process.

Because the update failed, the old active trampoline image remains registered 
with ftrace or direct calls. However, the link teardown will unconditionally 
free the linked BPF program:

kernel/bpf/syscall.c:bpf_link_dealloc() {
    ...
    if (link->prog)
        bpf_prog_put(link->prog);
    ...
}

Furthermore, bpf_trampoline_put() might also free the trampoline itself while
ftrace is still calling it. This happens because the program was eagerly
removed from the hlist before the update failed, allowing the emptiness check
to pass:

kernel/bpf/trampoline.c:bpf_trampoline_put() {
    ...
    for (i = 0; i < BPF_TRAMP_MAX; i++)
        if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[i])))
            goto out;
    ...
    direct_ops_free(tr);
    kfree(tr);
}

Can a subsequent ftrace invocation hit the freed trampoline or execute the
freed BPF program and cause a crash?

>  
>  	bpf_trampoline_put(tr_link->trampoline);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260726230724742Z4CDN9ntFInEofAf2YxME@zte.com.cn?part=1

Re: [PATCH bpf-next v2] bpf: Log error code on trampoline unlink failure

[xu.xin16]

> Pre-existing issues:
> - [High] Use-After-Free due to flawed teardown design when bpf_trampoline_unlink_prog fails
> --
> 
> --- Patch [1]: [PATCH bpf-next v2] bpf: Log error code on trampoline unlink failure ---
> commit 8f743682724c96c3eba346cdcf6a1a3646dc28bd
> Author: xu xin <xu.xin16@zte.com.cn>
> 
> bpf: Log error code on trampoline unlink failure
> 
> Replace silent WARN_ON_ONCE with WARN_ONCE that prints the actual error
> code from bpf_trampoline_unlink_prog(). This aids debugging of race
> conditions during link teardown.
> 
> > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> > index 0ff9e3aa293d5..9cbe00bc8d051 100644
> > --- a/kernel/bpf/syscall.c
> > +++ b/kernel/bpf/syscall.c
> > @@ -3547,10 +3547,13 @@ static void bpf_tracing_link_release(struct bpf_link *link)
> >  {
> >      struct bpf_tracing_link *tr_link =
> >          container_of(link, struct bpf_tracing_link, link.link);
> > +    int err;
> >  
> > -    WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link.node,
> > -                        tr_link->trampoline,
> > -                        tr_link->tgt_prog));
> > +    err = bpf_trampoline_unlink_prog(&tr_link->link.node,
> > +                    tr_link->trampoline,
> > +                    tr_link->tgt_prog);
> > +    if (err)
> > +        WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);
> 
> [Severity: High]
> This isn't a bug introduced by this patch, but does this error path lead to a
> Use-After-Free?
> 
> If bpf_trampoline_unlink_prog() fails (for example, due to a memory allocation
> failure in bpf_tramp_image_alloc() during bpf_trampoline_update()), the caller
> logs the error here but continues the teardown process.
> 
> Because the update failed, the old active trampoline image remains registered 
> with ftrace or direct calls. However, the link teardown will unconditionally 
> free the linked BPF program:

the memory allocation failure case was discussed in previous thead, which seems
to be not a big problem [1]. So just ignoring this question.

[1] https://lore.kernel.org/all/9e36407a-22fb-0fc1-b147-ebdc12ea0823@meta.com/

Re: [PATCH bpf-next v2] bpf: Log error code on trampoline unlink failure

[Leon Hwang]

On 2026/7/26 23:07, xu.xin16@zte.com.cn wrote:
> From: xu xin <xu.xin16@zte.com.cn>
> 
> Replace silent WARN_ON_ONCE with WARN_ONCE that prints the actual error
> code from bpf_trampoline_unlink_prog(). This aids debugging of race
> conditions during link teardown, while keeping the warning rate limited
> to avoid log flooding.
> 
> This will be very helpful for speeding up trouble-shooting of some crash
> UAF due to bpf_trampoline_unlink_prog failures.
> 
> No functional change intended.

Is it "No change to unlink behavior"?

> 
> Signed-off-by: xu xin <xu.xin16@zte.com.cn>
> ---
> v1->v2:
> 1) clean the subject name by remove 'syscall' suggested by Leon Hwang
> https://lore.kernel.org/all/20a444b2-aeed-4af8-ba76-e994e2c14087@linux.dev/
> 2) Add up the missed case in kernel/bpf/trampoline.c:bpf_shim_tramp_link_release()
> 
> kernel/bpf/syscall.c    | 9 ++++++---
>  kernel/bpf/trampoline.c | 5 ++++-
>  2 files changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 6db306d23b47..2348dc33abf4 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3626,10 +3626,13 @@ static void bpf_tracing_link_release(struct bpf_link *link)
>  {
>  	struct bpf_tracing_link *tr_link =
>  		container_of(link, struct bpf_tracing_link, link.link);
> +	int err;
> 
> -	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link.node,
> -						tr_link->trampoline,
> -						tr_link->tgt_prog));
> +	err = bpf_trampoline_unlink_prog(&tr_link->link.node,
> +					tr_link->trampoline,
> +					tr_link->tgt_prog);
> +	if (err)
> +		WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);

'if (err)' here is unnecessary.

> 
>  	bpf_trampoline_put(tr_link->trampoline);
> 
> diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> index 1a721fc4bef5..dae3c2104ed4 100644
> --- a/kernel/bpf/trampoline.c
> +++ b/kernel/bpf/trampoline.c
> @@ -997,12 +997,15 @@ static void bpf_shim_tramp_link_release(struct bpf_link *link)
>  {
>  	struct bpf_shim_tramp_link *shim_link =
>  		container_of(link, struct bpf_shim_tramp_link, link.link);
> +	int err;
> 
>  	/* paired with 'shim_link->trampoline = tr' in bpf_trampoline_link_cgroup_shim */
>  	if (!shim_link->trampoline)
>  		return;
> 
> -	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link.node, shim_link->trampoline, NULL));
> +	err = bpf_trampoline_unlink_prog(&shim_link->link.node, shim_link->trampoline, NULL);
> +	if (err)
> +		WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);

Ditto.

>  	bpf_trampoline_put(shim_link->trampoline);
>  }
> 

Would it be better to include this multi_detach() one?

		WARN_ON_ONCE(__bpf_trampoline_unlink_prog(&mnode->node, mnode->trampoline,
					NULL, &trampoline_multi_ops, data));

Thanks,
Leon