From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-173.mta1.migadu.com (mta1.migadu.com [37.59.57.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C5FD542B301 for ; Tue, 11 Aug 2026 09:31:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=37.59.57.117 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786440676; cv=none; b=OlaPN1dg68f+jwEiQfGmHKzv0NuxDIXuSqLYAH1yCpRiOFMFkXaIs/ygAv81plBNm6s2INAV5Z/rAilFyA43IoiZCbR26LU9WcFiDG5u3tCBUHVlGVZMGEv+Fu5V5AEWvIQ86864RF1YSHUP7YNpep8LTQp/x3nYgNeb45HXcwg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786440676; c=relaxed/simple; bh=vjN382zaD3W3AfZm4S8E60Ezsi7rVCHb6+sxgaIu160=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=NQedREbbNNt9S+9l5sNpqvsyEFIsM0S7Y6nTA86QwZxSsdV83W1L39eSA0ckeUVg0F3bmB0yD7wTJsjTqQ6ULGq6zWShBK+QIhILoj9lbC1mgjCHtkFHkpZwbP3rAuY5GN/BT5opn4/cqifQ7/NQX7G0NAuDTn+iMUWOTQ2knTM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=kMfAP+ps; arc=none smtp.client-ip=37.59.57.117 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="kMfAP+ps" Message-ID: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1786440671; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=KITcXi22MZEnWnu4Q+OD0XY/FmQzFgkLflaLpVkQ9WQ=; b=kMfAP+psQ3j43S3YTrjhSjiydP48dbmoMC39GiqBDnu19vriCmdE5afmfIVppXjSi2QmOu rLZg6L4LDRAdT6cCwaJGz5KuRjHLJwzT5+gw3qY7htIuxL91rA7kvp/bmGf6Y4VFfV7JGM rt3hYxWPIAQ4eA4sAxGumfsrZvyWeJY= Date: Tue, 11 Aug 2026 17:30:45 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [PATCH bpf-next v5 0/2] bpf: Fix trampoline image UAF on multi detach failure To: Hui Zhu , Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , KP Singh , Matt Bobrowski , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org Cc: Hui Zhu References: Content-Language: en-US X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Leon Hwang In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Migadu-Flow: FLOW_OUT On 11/8/26 10:46, Hui Zhu wrote: > From: Hui Zhu > > This series fixes a UAF in bpf_trampoline_multi_attach_free() where > old_image is freed while ftrace still calls into it, and makes > bpf_trampoline_multi_detach() return void as suggested by Jiri Olsa. > > Patch 1 fixes the UAF. Patch 2 is an independent cleanup that > changes the return type to void and drops the WARN_ON_ONCE at the > call site. The UAF issue was reported by Sashiko when reviewing "bpf: Add tracing_multi link support for bpf progs" [1]. The fix and the cleanup look good to me. Acked-by: Leon Hwang [1] https://sashiko.dev/#/message/20260809153308.5331D1F000E9%40smtp.kernel.org > [...]