Re: [PATCH bpf-next 0/4] bpf: Disable private stacks for uprobe programs

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Wed, Nov 04, 2026 at 06:17 AM Jiri Olsa <olsajiri@gmail.com> wrote:
> should we also ban all kprobe.multi programs in here?
>
> checking only jits_use_priv_stack on the entry program may miss a
> private-stack tail-call target, like:

Good point. Yes.

> +	if (is_uprobe &&
> +	    (prog->aux->jits_use_priv_stack ||
> +	     prog->expected_attach_type == BPF_TRACE_KPROBE_MULTI ||
> +	     prog->expected_attach_type == BPF_TRACE_KPROBE_SESSION))
>  		return -EINVAL;

can we ban all four multi and session types, on kprobe events too ?
like your commit db8eae6bc5c7 did for perf_link.
The ioctl still has that crash: bpf_get_attach_cookie() in a kprobe.multi
prog reads bpf_trace_run_ctx as bpf_kprobe_multi_run_ctx.
Then no need for is_uprobe and jits_use_priv_stack in this check.
Like:

	if (prog->type == BPF_PROG_TYPE_KPROBE &&
	    (prog->expected_attach_type == BPF_TRACE_KPROBE_MULTI ||
	     prog->expected_attach_type == BPF_TRACE_KPROBE_SESSION ||
	     prog->expected_attach_type == BPF_TRACE_UPROBE_MULTI ||
	     prog->expected_attach_type == BPF_TRACE_UPROBE_SESSION))
		return -EINVAL;