From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f42.google.com (mail-ej1-f42.google.com [209.85.218.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0A174432E60 for ; Tue, 11 Aug 2026 11:06:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786446407; cv=none; b=uhVdulCibJOjt+LQBj8b6zg0dEcG8gb4G4J+Tj+P/OOP3zSoaEcxOHxfrbjjvh3AvkxbKl0+uxhLmO1EssPglMYBtktrdiHozrs6X2gZQONWPc2esizRNr6ahwo0IPFMlQ/QA1i1mXr/K+EkjIplj/3BKvBKwIIEly//LCice/c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786446407; c=relaxed/simple; bh=tukP0gFXkGjbkkO6Sate91Hwdk6oZ5TQM06hGsQvC+U=; h=From:Date:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=kTwfk00yDznCel9U0MqswA6Ae5LDc/SaVwlnMzbBr6WLKnAvxPlEDrNxV9Uz5dtDR6zpLtYgee3r3vg6U08axcP3r4SyIZui/K/Zdd+PTKc9vqt0agV+7OD7sdCsqfNfz1zCpT9SfehmxErgnV2BBzI/+fq+kcKvJziKKZMai9Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PxtFFuBV; arc=none smtp.client-ip=209.85.218.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PxtFFuBV" Received: by mail-ej1-f42.google.com with SMTP id a640c23a62f3a-c15c42a45adso126713566b.0 for ; Tue, 11 Aug 2026 04:06:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786446401; x=1787051201; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:date:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=ncPBKBVNM6ovNcsCic32cHugMXoIYOhz070STPXc4TY=; b=PxtFFuBVzA94mCJ3JJ759NJiepI34WbXGkeLbqFaW7SIkE0SYvZzAEJdTw33amsc2q LUxSByhQxUvt2EnFnbM4ezb89uRIwnb0fZEwO/N1bY6doD+I8hqRErZnCj4tf9Ipw1gd 2jxWYffv+nLchU+5A15QXk4yhnseUNksra+DF7eDGzhywISBNhhjEtQhvkLEWqzgkrgW C8IsJl22qBLJ8TzT0hPsyoyMVjL8j0eBpLzjftMOj/yqTlzUy0b1ofTJYmnJDSwOox6N /TR/C5373pAFSlJ3kW+c9uHzNnVOaDWEeDX2ZBN0ChTTJc957HCZHGcYGldW8IabYuZP uNsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786446401; x=1787051201; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ncPBKBVNM6ovNcsCic32cHugMXoIYOhz070STPXc4TY=; b=iQHDEDJ8FgaIwiTKSxrZowpT3AO18b2SPKSHSdFHjbrp0K0gvG8VRvmkbPbq+Zx58N qEy6hHOgwxf0IWrK/5MDSpa3GAXlcKMn8ywHy5wSeqBZ66T6GqZckIw9riqAfvmdZX7O pw/Ze4Kw3iWVttfGxk2uCbA2kCVhIzmX8Qs5LfUXqf4PfTeBPqEspAJ3qMjr35dKVqNG FGj9ny4YqIgUWq0/vsYYnJwaELRPKF/kDup5GRb25RWIk0NvENAAHXkQYeisFMfRQQCk CMRU6APK85AZ6JdlpYZWtIhGF/OaYIHoYGtd1qrtjNamj8VAHIxLWiXu0TfXw9CmS2Na aTaA== X-Forwarded-Encrypted: i=1; AHgh+RrJRkDqZT+p+8KA7Vky3uGttm1TRDKOCGtSjbNW8XM3sMV5iBQEPOXT0sE8jPIqPLySnNnNsd6E4GAapQs=@vger.kernel.org X-Gm-Message-State: AOJu0Yy4XLLiDfX22Y6s0WStXfL1d63e/kGdcTn61XrJEsRlX2SUcQOb uFi8ICxx1Os+cKv/n6qFpKD5BNyY/HFoNePS0Z57DQyiNbVkoDJzKTZ3 X-Gm-Gg: AR+sD12uNyVIP5QZw60DauZkwo8ccFO0OYZ+xSjq+uRfD0NhXoIEHTn4HctXswYpFcx E6f0WWPxwcAv8TAEDUc4FWfXLpko3jOiU0vqq6M3ZyED0IK9Klg1kbgwaw0sstIDLg7CDJCZ4b7 krdjKn9H9yU0cpoGlviAEUYKJttRNMRp1cdVLx1X6Vg+rKWiKr7LJ2wicJvAl00UpKv/8h1X7ox +SnzNl5RDT069wrrrhpLYWjXvkeJVP7zZCN3lAZMXNrxUKEIbXS17+3FKDHCW5nOrTXfLl5G2bp fGxEVp3TnmtHNwOTBwr7st7Lsyd2e2v72VnHBmozMHlbxJMXu5mhYY6SgqMdaFtA3TmpYqw3JK/ P7Mh2f6EqzbAJWo+yrMl3vEOHAXOAW4P7Du8Wae+nAmKyVwbrEp7EqyUlpLVn5T7S18kbgzZDw4 BdS0QpAmEdwlP3mi9R/zQFGaRkv1DpnMzAwIv1fkFGag5drSelrV48HIp0sw== X-Received: by 2002:a17:907:3e0e:b0:c19:5bf1:368e with SMTP id a640c23a62f3a-c20e5ed6832mr106791266b.13.1786446401261; Tue, 11 Aug 2026 04:06:41 -0700 (PDT) Received: from krava ([173.38.220.33]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c20e414ddadsm37804266b.27.2026.08.11.04.06.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Aug 2026 04:06:40 -0700 (PDT) From: Jiri Olsa X-Google-Original-From: Jiri Olsa Date: Tue, 11 Aug 2026 13:06:39 +0200 To: Hui Zhu Cc: Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Emil Tsalapatis , Ihor Solodrai , KP Singh , Matt Bobrowski , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, Hui Zhu Subject: Re: [PATCH bpf-next v5 0/2] bpf: Fix trampoline image UAF on multi detach failure Message-ID: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Tue, Aug 11, 2026 at 10:46:18AM +0800, Hui Zhu wrote: > From: Hui Zhu > > This series fixes a UAF in bpf_trampoline_multi_attach_free() where > old_image is freed while ftrace still calls into it, and makes > bpf_trampoline_multi_detach() return void as suggested by Jiri Olsa. > > Patch 1 fixes the UAF. Patch 2 is an independent cleanup that > changes the return type to void and drops the WARN_ON_ONCE at the > call site. > > Changelog: > v5: > According to the comments of bot+bpf-ci, split the single patch into > two: the bug fix and the return-type cleanup. > v4: > According to the comments of bot+bpf-ci, add Fixes: and update comments > of bpf_trampoline_multi_attach_free. > v3: > According to the comments of Jiri Olsa, drop patches 2/3 and the > prog-side machinery. > keep only the simplified image-side fix in > bpf_trampoline_multi_attach_free() and make > bpf_trampoline_multi_detach() return void. > v2: > Folded v1's two detach patches into patch 1. > According to the comments of Jiri Olsa, Pin the prog (pinned_prog) on > cur_image so it stays alive while ftrace may still call into it. > Make bpf_trampoline_multi_detach() return void. > Fix the same UAF in standard (non-multi) trampolines. > According to the comments of sashiko, Fix the prog UAF in > bpf_trampoline_multi_attach() rollback. > Leak the trampoline in bpf_trampoline_put() when cur_image is left > by a rollback. > > Hui Zhu (2): > bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure > bpf: Make bpf_trampoline_multi_detach return void Acked-by: Jiri Olsa thanks, jirka