Re: [PATCH v4] bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure

> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index b4a10c9878cf..f4e8d372253a 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -1518,8 +1518,8 @@ int arch_prepare_bpf_dispatcher(void *image, void *buf, s64 *funcs, int num_func
>
>  int bpf_trampoline_multi_attach(struct bpf_prog *prog, u32 *ids,
>  				struct bpf_tracing_multi_link *link);
> -int bpf_trampoline_multi_detach(struct bpf_prog *prog,
> -				struct bpf_tracing_multi_link *link);
> +void bpf_trampoline_multi_detach(struct bpf_prog *prog,
> +				 struct bpf_tracing_multi_link *link);

[ ... ]

> diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> index e07af35ed040..90b70ea0d370 100644
> --- a/kernel/bpf/trampoline.c
> +++ b/kernel/bpf/trampoline.c

[ ... ]

> @@ -1756,7 +1766,8 @@ int bpf_trampoline_multi_attach(struct bpf_prog *prog, u32 *ids,
>  	return err;
>  }
>
> -int bpf_trampoline_multi_detach(struct bpf_prog *prog, struct bpf_tracing_multi_link *link)
> +void bpf_trampoline_multi_detach(struct bpf_prog *prog,
> +				 struct bpf_tracing_multi_link *link)

[ ... ]

> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 891897f8a1b3..29260951aa87 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -3687,7 +3687,7 @@ static void bpf_tracing_multi_link_release(struct bpf_link *link)
>  	struct bpf_tracing_multi_link *tr_link =
>  		container_of(link, struct bpf_tracing_multi_link, link);
>
> -	WARN_ON_ONCE(bpf_trampoline_multi_detach(link->prog, tr_link));
> +	bpf_trampoline_multi_detach(link->prog, tr_link);
>  }

This isn't a bug, but would it be worth splitting the return-type
change into its own patch?

The int-to-void conversion of bpf_trampoline_multi_detach() touches
both bpf.h prototypes, the definition and the bpf_trace.c call site,
but is independent of the old_image lifetime fix that the Fixes: tag
refers to.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31362089875