* Forwarded: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link_dealloc
2026-02-21 4:46 [syzbot] [trace?] [bpf?] KASAN: slab-use-after-free Read in bpf_trace_run2 (3) syzbot
@ 2026-02-21 5:19 ` syzbot
2026-02-21 5:41 ` syzbot
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-02-21 5:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link_dealloc
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
When a BPF raw tracepoint link is released, bpf_raw_tp_link_release()
calls bpf_probe_unregister(), which internally calls
tracepoint_probe_unregister(). This function performs an RCU-deferred
swap of the tracepoint's funcs array via call_rcu(), so that existing
readers can finish observing the old array (which still references the
link) before it is replaced.
Concurrently, bpf_link_put_direct() schedules its own call_rcu() to
invoke bpf_raw_tp_link_dealloc(). Since both call_rcu() calls are
issued at roughly the same time, the dealloc grace period can complete
before the tracepoint's internal grace period. When this happens,
kfree(raw_tp) runs while RCU readers can still reach the link via the
old funcs array, causing a use-after-free in __bpf_trace_run() when it
dereferences link->link.prog.
Fix this by replacing kfree(raw_tp) with kfree_rcu(raw_tp, rcu),
adding an rcu_head field to struct bpf_raw_tp_link. This ensures a
third grace period elapses before the memory is freed, guaranteeing
that all readers which could have observed the old funcs array have
completed before the link is released.
Reported-by: syzbot+59701a78e84b0bccfe1b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=59701a78e84b0bccfe1b
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
include/linux/bpf.h | 1 +
kernel/bpf/syscall.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index cd9b96434904..673d19b360a7 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1893,6 +1893,7 @@ struct bpf_raw_tp_link {
struct bpf_link link;
struct bpf_raw_event_map *btp;
u64 cookie;
+ struct rcu_head rcu;
};
struct bpf_link_primer {
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index dd89bf809772..b9dfc36d8a77 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3790,7 +3790,7 @@ static void bpf_raw_tp_link_dealloc(struct bpf_link *link)
struct bpf_raw_tp_link *raw_tp =
container_of(link, struct bpf_raw_tp_link, link);
- kfree(raw_tp);
+ kfree_rcu(raw_tp, rcu);
}
static void bpf_raw_tp_link_show_fdinfo(const struct bpf_link *link,
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Forwarded: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link_dealloc
2026-02-21 4:46 [syzbot] [trace?] [bpf?] KASAN: slab-use-after-free Read in bpf_trace_run2 (3) syzbot
2026-02-21 5:19 ` Forwarded: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link_dealloc syzbot
@ 2026-02-21 5:41 ` syzbot
2026-02-21 6:42 ` Forwarded: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link_release syzbot
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-02-21 5:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link_dealloc
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
When a BPF raw tracepoint link is released, bpf_raw_tp_link_release()
calls bpf_probe_unregister(), which internally calls
tracepoint_probe_unregister(). This function performs an RCU-deferred
swap of the tracepoint's funcs array via call_rcu(), so that existing
readers can finish observing the old array (which still references the
link) before it is replaced.
Concurrently, bpf_link_put_direct() schedules its own call_rcu() to
invoke bpf_raw_tp_link_dealloc(). Since both call_rcu() calls are
issued at roughly the same time, the dealloc grace period can complete
before the tracepoint's internal grace period. When this happens,
kfree(raw_tp) runs while RCU readers can still reach the link via the
old funcs array, causing a use-after-free in __bpf_trace_run() when it
dereferences link->link.prog.
Fix this by replacing kfree(raw_tp) with kfree_rcu(raw_tp, rcu),
adding an rcu_head field to struct bpf_raw_tp_link. This ensures a
third grace period elapses before the memory is freed, guaranteeing
that all readers which could have observed the old funcs array have
completed before the link is released.
Reported-by: syzbot+59701a78e84b0bccfe1b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=59701a78e84b0bccfe1b
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
include/linux/bpf.h | 1 +
kernel/bpf/syscall.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index cd9b96434904..673d19b360a7 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1893,6 +1893,7 @@ struct bpf_raw_tp_link {
struct bpf_link link;
struct bpf_raw_event_map *btp;
u64 cookie;
+ struct rcu_head rcu;
};
struct bpf_link_primer {
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index dd89bf809772..b9dfc36d8a77 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3790,7 +3790,7 @@ static void bpf_raw_tp_link_dealloc(struct bpf_link *link)
struct bpf_raw_tp_link *raw_tp =
container_of(link, struct bpf_raw_tp_link, link);
- kfree(raw_tp);
+ kfree_rcu(raw_tp, rcu);
}
static void bpf_raw_tp_link_show_fdinfo(const struct bpf_link *link,
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Forwarded: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link_release
2026-02-21 4:46 [syzbot] [trace?] [bpf?] KASAN: slab-use-after-free Read in bpf_trace_run2 (3) syzbot
2026-02-21 5:19 ` Forwarded: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link_dealloc syzbot
2026-02-21 5:41 ` syzbot
@ 2026-02-21 6:42 ` syzbot
2026-02-21 10:45 ` syzbot
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-02-21 6:42 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link_release
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
When a BPF raw tracepoint link is released, bpf_raw_tp_link_release()
calls bpf_probe_unregister(), which internally calls
tracepoint_probe_unregister(). This function performs an RCU-deferred
swap of the tracepoint's funcs array via call_rcu(), so that existing
readers can finish observing the old array before it is replaced.
However, the subsequent call_rcu() in bpf_link_put_direct() that
invokes bpf_raw_tp_link_dealloc() can complete concurrently with the
tracepoint's internal grace period. When this happens, kfree(raw_tp)
runs while RCU readers can still reach the link via the old funcs
array, causing a use-after-free in __bpf_trace_run() when it
dereferences link->link.prog.
Fix this by calling synchronize_rcu() after bpf_probe_unregister() in
bpf_raw_tp_link_release(). This ensures all pre-existing readers that
may still be executing __bpf_trace_run() with a pointer to this link
have finished before we return. The subsequent call_rcu() for dealloc
will then fire only after the link is truly unreachable, making the
kfree() safe.
Reported-by: syzbot+59701a78e84b0bccfe1b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=59701a78e84b0bccfe1b
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
kernel/bpf/syscall.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index dd89bf809772..e636a2022e54 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3782,6 +3782,7 @@ static void bpf_raw_tp_link_release(struct bpf_link *link)
container_of(link, struct bpf_raw_tp_link, link);
bpf_probe_unregister(raw_tp->btp, raw_tp);
+ synchronize_rcu();
bpf_put_raw_tracepoint(raw_tp->btp);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Forwarded: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link_release
2026-02-21 4:46 [syzbot] [trace?] [bpf?] KASAN: slab-use-after-free Read in bpf_trace_run2 (3) syzbot
` (2 preceding siblings ...)
2026-02-21 6:42 ` Forwarded: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link_release syzbot
@ 2026-02-21 10:45 ` syzbot
2026-02-21 12:07 ` Forwarded: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link on tracepoint unregistration syzbot
2026-02-21 23:34 ` syzbot
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-02-21 10:45 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link_release
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
When a BPF raw tracepoint link is released, bpf_raw_tp_link_release()
calls bpf_probe_unregister(), which internally calls
tracepoint_probe_unregister(). This function performs an RCU-deferred
swap of the tracepoint's funcs array via call_rcu(), so that existing
readers can finish observing the old array before it is replaced.
However, the subsequent call_rcu() in bpf_link_put_direct() that
invokes bpf_raw_tp_link_dealloc() can complete concurrently with the
tracepoint's internal grace period. When this happens, kfree(raw_tp)
runs while RCU readers can still reach the link via the old funcs
array, causing a use-after-free in __bpf_trace_run() when it
dereferences link->link.prog.
Fix this by calling synchronize_rcu() after bpf_probe_unregister() in
bpf_raw_tp_link_release(). This ensures all pre-existing readers that
may still be executing __bpf_trace_run() with a pointer to this link
have finished before we return. The subsequent call_rcu() for dealloc
will then fire only after the link is truly unreachable, making the
kfree() safe.
Reported-by: syzbot+59701a78e84b0bccfe1b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=59701a78e84b0bccfe1b
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
kernel/bpf/syscall.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index dd89bf809772..e636a2022e54 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3782,6 +3782,7 @@ static void bpf_raw_tp_link_release(struct bpf_link *link)
container_of(link, struct bpf_raw_tp_link, link);
bpf_probe_unregister(raw_tp->btp, raw_tp);
+ synchronize_rcu();
bpf_put_raw_tracepoint(raw_tp->btp);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Forwarded: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link on tracepoint unregistration
2026-02-21 4:46 [syzbot] [trace?] [bpf?] KASAN: slab-use-after-free Read in bpf_trace_run2 (3) syzbot
` (3 preceding siblings ...)
2026-02-21 10:45 ` syzbot
@ 2026-02-21 12:07 ` syzbot
2026-02-21 23:34 ` syzbot
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-02-21 12:07 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link on tracepoint unregistration
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
A slab-use-after-free is reported by KASAN in __bpf_trace_run /
bpf_trace_run2 when a BPF raw tracepoint link is being torn down
while the tracepoint is concurrently firing on another CPU.
The tracepoint invocation path protects its read side with SRCU
(srcu_read_lock_fast_notrace(&tracepoint_srcu)), but when a BPF raw
tracepoint link is released, bpf_link_free() defers the kfree of the
bpf_raw_tp_link via call_rcu(), which only waits for a regular RCU
grace period. Since regular RCU and SRCU are independent
synchronization domains, call_rcu() does not wait for in-flight SRCU
readers. This means the bpf_raw_tp_link can be freed while a
tracepoint callback is still accessing it, leading to a
use-after-free.
Fix this by calling tracepoint_synchronize_unregister() after
bpf_probe_unregister() in bpf_raw_tp_link_release(). This function
calls synchronize_srcu(&tracepoint_srcu), ensuring all in-flight
tracepoint callbacks have completed before the link enters the
RCU-deferred free path in bpf_link_free().
Reported-by: syzbot+59701a78e84b0bccfe1b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=59701a78e84b0bccfe1b
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
kernel/bpf/syscall.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index dd89bf809772..af6d435dd500 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3782,6 +3782,7 @@ static void bpf_raw_tp_link_release(struct bpf_link *link)
container_of(link, struct bpf_raw_tp_link, link);
bpf_probe_unregister(raw_tp->btp, raw_tp);
+ tracepoint_synchronize_unregister();
bpf_put_raw_tracepoint(raw_tp->btp);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Forwarded: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link on tracepoint unregistration
2026-02-21 4:46 [syzbot] [trace?] [bpf?] KASAN: slab-use-after-free Read in bpf_trace_run2 (3) syzbot
` (4 preceding siblings ...)
2026-02-21 12:07 ` Forwarded: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link on tracepoint unregistration syzbot
@ 2026-02-21 23:34 ` syzbot
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-02-21 23:34 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] bpf: Fix use-after-free in bpf_raw_tp_link on tracepoint unregistration
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
A slab-use-after-free is reported by KASAN in __bpf_trace_run /
bpf_trace_run2 when a BPF raw tracepoint link is being torn down
while the tracepoint is concurrently firing on another CPU.
The tracepoint invocation path protects its read side with SRCU
(srcu_read_lock_fast_notrace(&tracepoint_srcu)), but when a BPF raw
tracepoint link is released, bpf_link_free() defers the kfree of the
bpf_raw_tp_link via call_rcu(), which only waits for a regular RCU
grace period. Since regular RCU and SRCU are independent
synchronization domains, call_rcu() does not wait for in-flight SRCU
readers. This means the bpf_raw_tp_link can be freed while a
tracepoint callback is still accessing it, leading to a
use-after-free.
Fix this by calling tracepoint_synchronize_unregister() after
bpf_probe_unregister() in bpf_raw_tp_link_release(). This function
calls synchronize_srcu(&tracepoint_srcu), ensuring all in-flight
tracepoint callbacks have completed before the link enters the
RCU-deferred free path in bpf_link_free().
Reported-by: syzbot+59701a78e84b0bccfe1b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=59701a78e84b0bccfe1b
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
kernel/bpf/syscall.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index dd89bf809772..af6d435dd500 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3782,6 +3782,7 @@ static void bpf_raw_tp_link_release(struct bpf_link *link)
container_of(link, struct bpf_raw_tp_link, link);
bpf_probe_unregister(raw_tp->btp, raw_tp);
+ tracepoint_synchronize_unregister();
bpf_put_raw_tracepoint(raw_tp->btp);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 7+ messages in thread