Re: [PATCH bpf-next 1/2 v3] bpf: Add LINK_DETACH support for perf link

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Concurrent execution of BPF_LINK_DETACH and BPF_OBJ_GET_INFO_BY_FD (or /proc/pid/fdinfo reads) causes a NULL pointer dereference on event->prog.
--

commit 738bb49794369ff2bcc7c3d461300bd57e714cf5
Author: Florian Lehner <dev@der-flo.net>

bpf: Add LINK_DETACH support for perf link

This commit implements the .detach operation for bpf_perf_link, allowing
BPF_LINK_DETACH to release the perf event without destroying the link object.

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c

[ ... ]

> @@ -4095,22 +4117,42 @@ static int bpf_perf_link_fill_link_info(const struct bpf_link *link,
>  {
>  	struct bpf_perf_link *perf_link;
>  	const struct perf_event *event;
> +	struct file *perf_file;
> +	int ret;
>  
>  	perf_link = container_of(link, struct bpf_perf_link, link);
> -	event = perf_get_event(perf_link->perf_file);
> -	if (IS_ERR(event))
> +
> +	mutex_lock(&bpf_perf_link_mutex);
> +	perf_file = perf_link->perf_file;
> +	if (perf_file)
> +		get_file(perf_file);
> +	mutex_unlock(&bpf_perf_link_mutex);
> +
> +	if (!perf_file)
> +		return 0;
> +
> +	event = perf_get_event(perf_file);
> +	if (IS_ERR(event)) {
> +		fput(perf_file);
>  		return PTR_ERR(event);
> +	}
>  
>  	switch (event->prog->type) {

Can this result in a NULL pointer dereference on event->prog?

If a concurrent BPF_LINK_DETACH triggers bpf_perf_link_release(), it sets
perf_link->perf_file = NULL under the mutex, drops the mutex, and then calls
perf_event_free_bpf_prog(event).

If perf_event_free_bpf_prog() clears event->prog right after we drop the
mutex here but before we evaluate the switch statement, evaluating
event->prog->type could panic.

Would it be safer to use link->prog->type instead? The program reference in
link->prog is pinned for the lifetime of the link object.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260501160901.224134-1-dev@der-flo.net?part=1