Re: [PATCH bpf-next v5 0/2] bpf: Fix trampoline image UAF on multi detach failure
Leon Hwang <[email protected]>
| Newsgroups | org.kernel.vger.bpf,org.kernel.vger.linux-kernel,org.kernel.vger.linux-trace-kernel |
|---|---|
| Message-ID | <[email protected]> |
On 11/8/26 10:46, Hui Zhu wrote: > From: Hui Zhu <[email protected]> > > This series fixes a UAF in bpf_trampoline_multi_attach_free() where > old_image is freed while ftrace still calls into it, and makes > bpf_trampoline_multi_detach() return void as suggested by Jiri Olsa. > > Patch 1 fixes the UAF. Patch 2 is an independent cleanup that > changes the return type to void and drops the WARN_ON_ONCE at the > call site. The UAF issue was reported by Sashiko when reviewing "bpf: Add tracing_multi link support for bpf progs" [1]. The fix and the cleanup look good to me. Acked-by: Leon Hwang <[email protected]> [1] https://sashiko.dev/#/message/20260809153308.5331D1F000E9%40smtp.kernel.org > [...]