Re: [PATCH bpf-next 1/6] bpf: Add syscall common attrs support for link_create

[Leon Hwang <leon.hwang@linux.dev>]

On 2026/10/17 22:39, sashiko-bot@kernel.org wrote:

[...]

>>  out:
>> -	if (ret < 0)
>> +	/* preserve original error even if log finalization is successful */
>> +	err = bpf_log_attr_finalize(&attr_log, log);
>> +	if (err)
>> +		ret = err;
>> +
>> +	kfree(log);
>> +
>> +	if (ret < 0 && prog)
>>  		bpf_prog_put(prog);
>>  	return ret;
>>  }
> 
> [Severity: Critical]
> Can this underflow the refcount on prog and leak the newly installed link
> file descriptor if bpf_log_attr_finalize() fails after link attachment
> succeeds?

Correct.

To avoid such prog leak, I'd like to report the log_true_size twice.

ret = bpf_log_attr_report_size(&attr_log, 0);
if (ret)
	goto out;

switch (prog->type) {
	/* ... */
}

out:
if (ret) {
	int err =  bpf_log_attr_finalize(&attr_log, log);

	ret = err ? err : ret;
}

if (ret < 0 && prog)
	bpf_prog_put(prog);

kfree(log);
return ret;

Thanks,
Leon

> [...]