1. Patchew
  2. linux
  3. [PATCH bpf-next v2 0/2] bpf: Fix abuse of kprobe_write_ctx via freplace
  4. View patch

[PATCH bpf-next v2 1/2] bpf: Fix abuse of kprobe_write_ctx via freplace

Leon Hwang posted 2 patches 1 week ago
There is a newer version of this series
[PATCH bpf-next v2 1/2] bpf: Fix abuse of kprobe_write_ctx via freplace
Posted by Leon Hwang 1 week ago 
uprobe programs are allowed to modify struct pt_regs.

Since the actual program type of uprobe is KPROBE, it can be abused to
modify struct pt_regs via kprobe+freplace when the kprobe attaches to
kernel functions.

For example,

SEC("?kprobe")
int kprobe(struct pt_regs *regs)
{
	return 0;
}

SEC("?freplace")
int freplace_kprobe(struct pt_regs *regs)
{
	regs->di = 0;
	return 0;
}

freplace_kprobe prog will attach to kprobe prog.
kprobe prog will attach to a kernel function.

Without this patch, when the kernel function runs, its first arg will
always be set as 0 via the freplace_kprobe prog.

To fix the abuse of kprobe_write_ctx=true via kprobe+freplace, disallow
attaching freplace programs on kprobe programs with different
kprobe_write_ctx values.

Fixes: 7384893d970e ("bpf: Allow uprobe program to change context registers")
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
---
 kernel/bpf/syscall.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 51ade3cde8bb..1dd2ea076d8b 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3733,6 +3733,11 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
 		tr = prog->aux->dst_trampoline;
 		tgt_prog = prog->aux->dst_prog;
 	}
+	if (prog->type == BPF_PROG_TYPE_EXT &&
+	    prog->aux->kprobe_write_ctx != tgt_prog->aux->kprobe_write_ctx) {
+		err = -EINVAL;
+		goto out_unlock;
+	}
 
 	err = bpf_link_prime(&link->link.link, &link_primer);
 	if (err)
-- 
2.53.0
Re: [PATCH bpf-next v2 1/2] bpf: Fix abuse of kprobe_write_ctx via freplace
Posted by Jiri Olsa 3 days, 10 hours ago 
On Thu, Mar 26, 2026 at 10:17:17PM +0800, Leon Hwang wrote:
> uprobe programs are allowed to modify struct pt_regs.
> 
> Since the actual program type of uprobe is KPROBE, it can be abused to
> modify struct pt_regs via kprobe+freplace when the kprobe attaches to
> kernel functions.
> 
> For example,
> 
> SEC("?kprobe")
> int kprobe(struct pt_regs *regs)
> {
> 	return 0;
> }
> 
> SEC("?freplace")
> int freplace_kprobe(struct pt_regs *regs)
> {
> 	regs->di = 0;
> 	return 0;
> }
> 
> freplace_kprobe prog will attach to kprobe prog.
> kprobe prog will attach to a kernel function.
> 
> Without this patch, when the kernel function runs, its first arg will
> always be set as 0 via the freplace_kprobe prog.
> 
> To fix the abuse of kprobe_write_ctx=true via kprobe+freplace, disallow
> attaching freplace programs on kprobe programs with different
> kprobe_write_ctx values.
> 
> Fixes: 7384893d970e ("bpf: Allow uprobe program to change context registers")
> Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
> ---
>  kernel/bpf/syscall.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 51ade3cde8bb..1dd2ea076d8b 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3733,6 +3733,11 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
>  		tr = prog->aux->dst_trampoline;
>  		tgt_prog = prog->aux->dst_prog;
>  	}

could you please put some comment in here explaining the check, with that

Acked-by: Jiri Olsa <jolsa@kernel.org>

thanks,
jirka


> +	if (prog->type == BPF_PROG_TYPE_EXT &&
> +	    prog->aux->kprobe_write_ctx != tgt_prog->aux->kprobe_write_ctx) {
> +		err = -EINVAL;
> +		goto out_unlock;
> +	}
>  
>  	err = bpf_link_prime(&link->link.link, &link_primer);
>  	if (err)
> -- 
> 2.53.0
>
Re: [PATCH bpf-next v2 1/2] bpf: Fix abuse of kprobe_write_ctx via freplace
Posted by Leon Hwang 3 days, 6 hours ago 
On 2026/3/30 17:28, Jiri Olsa wrote:
> On Thu, Mar 26, 2026 at 10:17:17PM +0800, Leon Hwang wrote:
[...]
>> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
>> index 51ade3cde8bb..1dd2ea076d8b 100644
>> --- a/kernel/bpf/syscall.c
>> +++ b/kernel/bpf/syscall.c
>> @@ -3733,6 +3733,11 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
>>  		tr = prog->aux->dst_trampoline;
>>  		tgt_prog = prog->aux->dst_prog;
>>  	}
> 
> could you please put some comment in here explaining the check, with that
> 

Sure, will add such comment:

	/*
	 * It is to prevent modifying struct pt_regs via kprobe_write_ctx=true
	 * freplace prog. Without this check, kprobe_write_ctx=true freplace
	 * prog is allowed to attach to kprobe_write_ctx=false kprobe prog, and
	 * then modify the registers of the kprobe prog's target kernel
	 * function.
	 *
	 * This also blocks the combination of uprobe+freplace, because it is
	 * unable to recognize the use of the tgt_prog as an uprobe or a kprobe
	 * by tgt_prog itself. At attach time, uprobe/kprobe is recognized by
	 * the target perf event flags in __perf_event_set_bpf_prog().
	 */

> Acked-by: Jiri Olsa <jolsa@kernel.org>
> 

Thanks for your review.

Thanks,
Leon
Re: [PATCH bpf-next v2 1/2] bpf: Fix abuse of kprobe_write_ctx via freplace
Posted by Song Liu 5 days, 22 hours ago 
On Thu, Mar 26, 2026 at 7:17 AM Leon Hwang <leon.hwang@linux.dev> wrote:
>
> uprobe programs are allowed to modify struct pt_regs.
>
> Since the actual program type of uprobe is KPROBE, it can be abused to
> modify struct pt_regs via kprobe+freplace when the kprobe attaches to
> kernel functions.
>
> For example,
>
> SEC("?kprobe")
> int kprobe(struct pt_regs *regs)
> {
>         return 0;
> }
>
> SEC("?freplace")
> int freplace_kprobe(struct pt_regs *regs)
> {
>         regs->di = 0;
>         return 0;
> }
>
> freplace_kprobe prog will attach to kprobe prog.
> kprobe prog will attach to a kernel function.
>
> Without this patch, when the kernel function runs, its first arg will
> always be set as 0 via the freplace_kprobe prog.
>
> To fix the abuse of kprobe_write_ctx=true via kprobe+freplace, disallow
> attaching freplace programs on kprobe programs with different
> kprobe_write_ctx values.
>
> Fixes: 7384893d970e ("bpf: Allow uprobe program to change context registers")
> Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
> ---
>  kernel/bpf/syscall.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 51ade3cde8bb..1dd2ea076d8b 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3733,6 +3733,11 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
>                 tr = prog->aux->dst_trampoline;
>                 tgt_prog = prog->aux->dst_prog;
>         }
> +       if (prog->type == BPF_PROG_TYPE_EXT &&
> +           prog->aux->kprobe_write_ctx != tgt_prog->aux->kprobe_write_ctx) {
> +               err = -EINVAL;
> +               goto out_unlock;
> +       }

This also blocks uprobe+freplace when prog and tgt_prog have different
kprobe_write_ctx, right? Is this the expected behavior?

Thanks,
Song
Re: [PATCH bpf-next v2 1/2] bpf: Fix abuse of kprobe_write_ctx via freplace
Posted by Leon Hwang 3 days, 14 hours ago 
On 28/3/26 05:39, Song Liu wrote:
> On Thu, Mar 26, 2026 at 7:17 AM Leon Hwang <leon.hwang@linux.dev> wrote:
[...]
>> @@ -3733,6 +3733,11 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
>>                 tr = prog->aux->dst_trampoline;
>>                 tgt_prog = prog->aux->dst_prog;
>>         }
>> +       if (prog->type == BPF_PROG_TYPE_EXT &&
>> +           prog->aux->kprobe_write_ctx != tgt_prog->aux->kprobe_write_ctx) {
>> +               err = -EINVAL;
>> +               goto out_unlock;
>> +       }
> 
> This also blocks uprobe+freplace when prog and tgt_prog have different
> kprobe_write_ctx, right? Is this the expected behavior?
> 

Intuitively, yes, this also blocks uprobe+freplace.

However, how can we distinguish uprobe/kprobe here?

At attach time, uprobe/kprobe is recognized by the target perf event
flags instead of BPF prog's expected_attach_type. Thus, we cannot infer
the use of prog by prog itself.

If we can distinguish them here, I'd like to do it.

Thanks,
Leon
Re: [PATCH bpf-next v2 1/2] bpf: Fix abuse of kprobe_write_ctx via freplace
Posted by Song Liu 3 days, 3 hours ago 
On Sun, Mar 29, 2026 at 10:38 PM Leon Hwang <leon.hwang@linux.dev> wrote:
>
> On 28/3/26 05:39, Song Liu wrote:
> > On Thu, Mar 26, 2026 at 7:17 AM Leon Hwang <leon.hwang@linux.dev> wrote:
> [...]
> >> @@ -3733,6 +3733,11 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
> >>                 tr = prog->aux->dst_trampoline;
> >>                 tgt_prog = prog->aux->dst_prog;
> >>         }
> >> +       if (prog->type == BPF_PROG_TYPE_EXT &&
> >> +           prog->aux->kprobe_write_ctx != tgt_prog->aux->kprobe_write_ctx) {
> >> +               err = -EINVAL;
> >> +               goto out_unlock;
> >> +       }
> >
> > This also blocks uprobe+freplace when prog and tgt_prog have different
> > kprobe_write_ctx, right? Is this the expected behavior?
> >
>
> Intuitively, yes, this also blocks uprobe+freplace.
>
> However, how can we distinguish uprobe/kprobe here?
>
> At attach time, uprobe/kprobe is recognized by the target perf event
> flags instead of BPF prog's expected_attach_type. Thus, we cannot infer
> the use of prog by prog itself.

Maybe we should introduce an attach type BPF_TRACE_UPROBE in a
backward compatible way:
- expected_attach_type = 0, it could be either kprobe or uprobe.
- expected_attach_type = BPF_TRACE_UPROBE, it must be an uprobe.

With this flag, we can allow uprobe+freplace when the user space sets
BPF_TRACE_UPROBE properly. WDYT?

Thanks,
Song
Re: [PATCH bpf-next v2 1/2] bpf: Fix abuse of kprobe_write_ctx via freplace
Posted by Alexei Starovoitov 3 days, 3 hours ago 
On Mon, Mar 30, 2026 at 9:44 AM Song Liu <song@kernel.org> wrote:
>
> On Sun, Mar 29, 2026 at 10:38 PM Leon Hwang <leon.hwang@linux.dev> wrote:
> >
> > On 28/3/26 05:39, Song Liu wrote:
> > > On Thu, Mar 26, 2026 at 7:17 AM Leon Hwang <leon.hwang@linux.dev> wrote:
> > [...]
> > >> @@ -3733,6 +3733,11 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
> > >>                 tr = prog->aux->dst_trampoline;
> > >>                 tgt_prog = prog->aux->dst_prog;
> > >>         }
> > >> +       if (prog->type == BPF_PROG_TYPE_EXT &&
> > >> +           prog->aux->kprobe_write_ctx != tgt_prog->aux->kprobe_write_ctx) {
> > >> +               err = -EINVAL;
> > >> +               goto out_unlock;
> > >> +       }
> > >
> > > This also blocks uprobe+freplace when prog and tgt_prog have different
> > > kprobe_write_ctx, right? Is this the expected behavior?
> > >
> >
> > Intuitively, yes, this also blocks uprobe+freplace.
> >
> > However, how can we distinguish uprobe/kprobe here?
> >
> > At attach time, uprobe/kprobe is recognized by the target perf event
> > flags instead of BPF prog's expected_attach_type. Thus, we cannot infer
> > the use of prog by prog itself.
>
> Maybe we should introduce an attach type BPF_TRACE_UPROBE in a
> backward compatible way:
> - expected_attach_type = 0, it could be either kprobe or uprobe.
> - expected_attach_type = BPF_TRACE_UPROBE, it must be an uprobe.
>
> With this flag, we can allow uprobe+freplace when the user space sets
> BPF_TRACE_UPROBE properly. WDYT?

New uapi just to fix a narrow bug? Not a good tradeoff.
Re: [PATCH bpf-next v2 1/2] bpf: Fix abuse of kprobe_write_ctx via freplace
Posted by Song Liu 3 days, 3 hours ago 
On Mon, Mar 30, 2026 at 10:09 AM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Mon, Mar 30, 2026 at 9:44 AM Song Liu <song@kernel.org> wrote:
> >
> > On Sun, Mar 29, 2026 at 10:38 PM Leon Hwang <leon.hwang@linux.dev> wrote:
> > >
> > > On 28/3/26 05:39, Song Liu wrote:
> > > > On Thu, Mar 26, 2026 at 7:17 AM Leon Hwang <leon.hwang@linux.dev> wrote:
> > > [...]
> > > >> @@ -3733,6 +3733,11 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
> > > >>                 tr = prog->aux->dst_trampoline;
> > > >>                 tgt_prog = prog->aux->dst_prog;
> > > >>         }
> > > >> +       if (prog->type == BPF_PROG_TYPE_EXT &&
> > > >> +           prog->aux->kprobe_write_ctx != tgt_prog->aux->kprobe_write_ctx) {
> > > >> +               err = -EINVAL;
> > > >> +               goto out_unlock;
> > > >> +       }
> > > >
> > > > This also blocks uprobe+freplace when prog and tgt_prog have different
> > > > kprobe_write_ctx, right? Is this the expected behavior?
> > > >
> > >
> > > Intuitively, yes, this also blocks uprobe+freplace.
> > >
> > > However, how can we distinguish uprobe/kprobe here?
> > >
> > > At attach time, uprobe/kprobe is recognized by the target perf event
> > > flags instead of BPF prog's expected_attach_type. Thus, we cannot infer
> > > the use of prog by prog itself.
> >
> > Maybe we should introduce an attach type BPF_TRACE_UPROBE in a
> > backward compatible way:
> > - expected_attach_type = 0, it could be either kprobe or uprobe.
> > - expected_attach_type = BPF_TRACE_UPROBE, it must be an uprobe.
> >
> > With this flag, we can allow uprobe+freplace when the user space sets
> > BPF_TRACE_UPROBE properly. WDYT?
>
> New uapi just to fix a narrow bug? Not a good tradeoff.

Agreed.

Maybe we should just land this set as-is and accept uprobe+freplace won't
work in certain cases. In this case:

Acked-by: Song Liu <song@kernel.org>

Thanks,
Song

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.