From nobody Fri Jul 24 22:48:54 2026 Received: from out-178.mta0.migadu.com (out-178.mta0.migadu.com [91.218.175.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7B68A375F88 for ; Wed, 22 Jul 2026 15:19:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784733599; cv=none; b=DDBRV6CNf0dtSMxxBP94umLS9qWs1GOxjoKM8b5r/JLTg1NzD17cEnGSWpVTCES0VPGQY+QCUXnDVzE0Pp2twGoxOO0BQvXa5WQLUANX1K9vTP3zxvMNm7e5ahh5g6rKLp0jeF9JAsyOyhZj967l6Y+VyA6FIj+m3c8B4ioXL6g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784733599; c=relaxed/simple; bh=i5Y8LBLIVi9NZXbiFyUAigdwHHkCtn2fo3m5k7f1Kac=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=u5thJoGlYPi6iCpfNWwv/gw5+OUrgDMjGg7FxeqYhIAC1HpOKP6uRgcJIwEKK4uCQw4QnW6croMIv+V34o57D2DRw5uPGfqmfgAvVNSGcrOhY0PFbsjc9fPiiFvDp4gInF1crMYroAGJJev+unC9Y5J93CDAhlppNyxi8PVQRXA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=rP6SWJRw; arc=none smtp.client-ip=91.218.175.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="rP6SWJRw" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1784733591; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hYTgWVcRbrysugLURttWCpGcYz3LG4GprKcAXdzH1sw=; b=rP6SWJRw4mfP9qp8M+vv00V5zK6gxv7Bl7QQOcJBP0RTHEqhD6DOiubdBnUG5+mqWjxNHT lXm34jmVUjHJMDbBLYmpcT8HbIYW5faznwfTv6eDvShX9RSJ5I4EIPuqJvniBaCI77vXQO aGuxT/AYa1cLQcYU5qvKMH2e44UHWos= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Shuah Khan , Jingguo Tan , Pu Lehui , Leon Hwang , Lin Ma , Maciej Fijalkowski , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next v2 1/2] bpf: Fix WARNING in bpf_tracing_link_release Date: Wed, 22 Jul 2026 23:19:08 +0800 Message-ID: <20260722151909.69142-2-leon.hwang@linux.dev> In-Reply-To: <20260722151909.69142-1-leon.hwang@linux.dev> References: <20260722151909.69142-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" The trampoline could be corrupted by the blindly 'tr->flags =3D BPF_TRAMP_F_TAIL_CALL_CTX' in verifier. 1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn. 2. Another fexit loaded with the same tail_call_reachable prog target. 'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'. 3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn. [ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_relea= se+0x53/0x60, CPU#1: test_progs/98 ... [ 3.428793] bpf_link_free+0x58/0x130 [ 3.429293] bpf_link_release+0x23/0x30 Fix the warning by updating 'tr->flags' with '|=3D' and lock. Fixes: 2b5dcb31a19a ("bpf, x64: Fix tailcall infinite loop") Acked-by: Jiri Olsa Signed-off-by: Leon Hwang Reviewed-by: Pu Lehui --- include/linux/bpf.h | 2 ++ kernel/bpf/trampoline.c | 7 +++++++ kernel/bpf/verifier.c | 2 +- 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index e066f44a9c05..7bfc28673124 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1523,6 +1523,7 @@ int bpf_trampoline_multi_attach(struct bpf_prog *prog= , u32 *ids, struct bpf_tracing_multi_link *link); int bpf_trampoline_multi_detach(struct bpf_prog *prog, struct bpf_tracing_multi_link *link); +void bpf_trampoline_set_flags(struct bpf_trampoline *tr, u32 flags); =20 /* * When the architecture supports STATIC_CALL replace the bpf_dispatcher_fn @@ -1646,6 +1647,7 @@ static inline int bpf_trampoline_multi_detach(struct = bpf_prog *prog, { return -ENOTSUPP; } +static inline void bpf_trampoline_set_flags(struct bpf_trampoline *tr, u32= flags) {} #endif =20 struct bpf_func_info_aux { diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c index 6eadf64f7ec9..129d07db117e 100644 --- a/kernel/bpf/trampoline.c +++ b/kernel/bpf/trampoline.c @@ -670,6 +670,13 @@ static struct bpf_tramp_image *bpf_tramp_image_alloc(u= 64 key, int size) return ERR_PTR(err); } =20 +void bpf_trampoline_set_flags(struct bpf_trampoline *tr, u32 flags) +{ + trampoline_lock(tr); + tr->flags |=3D flags; + trampoline_unlock(tr); +} + static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_dire= ct_mutex, const struct bpf_trampoline_ops *ops, void *data) { diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 52be0a118cce..66d8d9eaec05 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -19523,7 +19523,7 @@ static int check_attach_btf_id(struct bpf_verifier_= env *env) return -ENOMEM; =20 if (tgt_prog && tgt_prog->aux->tail_call_reachable) - tr->flags =3D BPF_TRAMP_F_TAIL_CALL_CTX; + bpf_trampoline_set_flags(tr, BPF_TRAMP_F_TAIL_CALL_CTX); =20 prog->aux->dst_trampoline =3D tr; return 0; --=20 2.55.0 From nobody Fri Jul 24 22:48:54 2026 Received: from out-179.mta0.migadu.com (out-179.mta0.migadu.com [91.218.175.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3AA3E37A83F for ; Wed, 22 Jul 2026 15:20:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784733608; cv=none; b=W4OBXmV+qxiVZE0EOdT6iW8PYM9mPK5yajWcAfJhACoH8RtjR529QDvGS8BNpxVdSa9hd4YzK7OassR3pMZXJuLsA0qpneq9hzFZ4dv7H4j9Xl0ZWsL4f8hqmOm2H4Fy1U6DAQxqxELnRPNkj9fs/jtgf3Ni0UfQNYcHn+WX3iI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784733608; c=relaxed/simple; bh=AUK1CkpWB3YJ6nNShoGFre6CvyeNBldHZzibhJ/Kzeg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LFI2jf4ZChphuH11SBXzSgP5Tgfh1jHnXsXs59962WA2TqRnmB2+y6SW9WnrX//xohbLKyZVeoGbtdpdL3B0dQWAOmFX6dGYz4PDinySfK2Q39t5VIq9v4MLnJG1ODQAtAgD79w8B/eWpuuEXrwNDzf/CfsJk8y/cmhrYdGI9ZU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=I4iVSPb+; arc=none smtp.client-ip=91.218.175.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="I4iVSPb+" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1784733600; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bFhLnlSq59bbqBUiEsR5Lhpwh+Img+fmsgmvB5qeBwE=; b=I4iVSPb+soza6UkOzJZmzaLTqG5jkBczDdixfC/oNqLiS7N2yZfnRpTEOMxtjRfkgMePAU 3k0G5dyoDgbZw9mb1bGlVuoodtecHvBFXovPq3qTmI6AHSAzt03Jhex6jnzLKMmknBAM7p Y3EHFDpQAKEuTy+rCjv9EMYYQjpRZNI= From: Leon Hwang To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Shuah Khan , Jingguo Tan , Pu Lehui , Leon Hwang , Lin Ma , Maciej Fijalkowski , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, kernel-patches-bot@fb.com Subject: [PATCH bpf-next v2 2/2] selftests/bpf: Verify no warning when close fexit link Date: Wed, 22 Jul 2026 23:19:09 +0800 Message-ID: <20260722151909.69142-3-leon.hwang@linux.dev> In-Reply-To: <20260722151909.69142-1-leon.hwang@linux.dev> References: <20260722151909.69142-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Add a test to verify that there's no WARNING when detaching fexit link by following the repro steps of previous commit. Without the fix, the WARNING could be triggered by this test. Acked-by: Jiri Olsa Signed-off-by: Leon Hwang Reviewed-by: Pu Lehui --- .../selftests/bpf/prog_tests/tailcalls.c | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/tailcalls.c b/tools/tes= ting/selftests/bpf/prog_tests/tailcalls.c index c66037162da5..c5c9d6c359bb 100644 --- a/tools/testing/selftests/bpf/prog_tests/tailcalls.c +++ b/tools/testing/selftests/bpf/prog_tests/tailcalls.c @@ -13,6 +13,8 @@ #include "tailcall_cgrp_storage.skel.h" #include "tailcall_sleepable.skel.h" #include "tailcall_callback.skel.h" +#include "tailcall_bpf2bpf2.skel.h" +#include "tailcall_bpf2bpf_fexit.skel.h" =20 /* test_tailcall_1 checks basic functionality by patching multiple locatio= ns * in a single program for a single tail call slot with nop->jmp, jmp->nop @@ -1907,6 +1909,50 @@ static void test_tailcall_callback(void) RUN_TESTS(tailcall_callback); } =20 +static void test_tailcall_bpf2bpf_fexit_links(void) +{ + struct tailcall_bpf2bpf_fexit *skel1 =3D NULL, *skel2 =3D NULL; + struct tailcall_bpf2bpf2 *skel_tc; + int err, prog_fd; + + skel_tc =3D tailcall_bpf2bpf2__open_and_load(); + if (!ASSERT_OK_PTR(skel_tc, "tailcall_bpf2bpf2__open_and_load")) + return; + + skel1 =3D tailcall_bpf2bpf_fexit__open(); + if (!ASSERT_OK_PTR(skel1, "tailcall_bpf2bpf_fexit__open")) + goto out; + + prog_fd =3D bpf_program__fd(skel_tc->progs.classifier_0); + err =3D bpf_program__set_attach_target(skel1->progs.fexit, prog_fd, "subp= rog_tail"); + if (!ASSERT_OK(err, "bpf_program__set_attach_target")) + goto out; + + err =3D tailcall_bpf2bpf_fexit__load(skel1); + if (!ASSERT_OK(err, "tailcall_bpf2bpf_fexit__load")) + goto out; + + skel1->links.fexit =3D bpf_program__attach_trace(skel1->progs.fexit); + if (!ASSERT_OK_PTR(skel1->links.fexit, "bpf_program__attach_trace")) + goto out; + + skel2 =3D tailcall_bpf2bpf_fexit__open(); + if (!ASSERT_OK_PTR(skel2, "tailcall_bpf2bpf_fexit__open")) + goto out; + + err =3D bpf_program__set_attach_target(skel2->progs.fexit, prog_fd, "subp= rog_tail"); + if (!ASSERT_OK(err, "bpf_program__set_attach_target")) + goto out; + + err =3D tailcall_bpf2bpf_fexit__load(skel2); + ASSERT_OK(err, "tailcall_bpf2bpf_fexit__load"); + +out: + tailcall_bpf2bpf_fexit__destroy(skel1); + tailcall_bpf2bpf_fexit__destroy(skel2); + tailcall_bpf2bpf2__destroy(skel_tc); +} + void test_tailcalls(void) { if (test__start_subtest("tailcall_1")) @@ -1974,4 +2020,6 @@ void test_tailcalls(void) if (test__start_subtest("tailcall_cgrp_storage_no_storage_bridge")) test_tailcall_cgrp_storage_no_storage_bridge(); test_tailcall_callback(); + if (test__start_subtest("tailcall_bpf2bpf_fexit_links")) + test_tailcall_bpf2bpf_fexit_links(); } --=20 2.55.0