* [PATCH bpf-next] bpf: Roll back freplace link state when bpf_arch_text_poke() fails [not found] <4669addf.91e8.1a0d2da9b9c.Coremail.chenyuan_fl@163.com> @ 2026-09-25 4:35 ` chenyuan_fl 2026-09-25 5:18 ` bot+bpf-ci 2026-09-25 6:05 ` Leon Hwang 0 siblings, 2 replies; 4+ messages in thread From: chenyuan_fl @ 2026-09-25 4:35 UTC (permalink / raw) To: bpf Cc: ast, daniel, andrii, eddyz87, memxor, jolsa, leon.hwang, linux-kernel, Yuan Chen From: Yuan Chen <chenyuan@kylinos.cn> A freplace attach claims the target prog by bumping tgt_prog->aux->freplace_link_cnt and setting tr->extension_prog. bpf_arch_text_poke() then makes the extension take effect. If the poke fails, the claims are never released: the attach unwinds through bpf_link_cleanup(), which clears link->prog, so bpf_trampoline_unlink_prog() never runs. Drop the link count under ext_mutex on the error path, and set tr->extension_prog only after the poke succeeded. The count is still bumped before the poke: it blocks prog_array updates while the entry is patched. Fixes: d6083f040d5d ("bpf: Prevent tailcall infinite loop caused by freplace") Suggested-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Yuan Chen <chenyuan@kylinos.cn> --- kernel/bpf/trampoline.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c index da85bd580ef0..bf4ab0ac264e 100644 --- a/kernel/bpf/trampoline.c +++ b/kernel/bpf/trampoline.c @@ -973,10 +973,17 @@ static int __bpf_trampoline_link_prog(struct bpf_tramp_node *node, err = bpf_freplace_link_tgt_prog(tgt_prog); if (err) return err; + err = bpf_arch_text_poke(tr->func.addr, BPF_MOD_NOP, + BPF_MOD_JUMP, NULL, + node->link->prog->bpf_func); + if (err) { + /* Undo the claim from bpf_freplace_link_tgt_prog(). */ + guard(mutex)(&tgt_prog->aux->ext_mutex); + tgt_prog->aux->freplace_link_cnt--; + return err; + } tr->extension_prog = node->link->prog; - return bpf_arch_text_poke(tr->func.addr, BPF_MOD_NOP, - BPF_MOD_JUMP, NULL, - node->link->prog->bpf_func); + return 0; } err = bpf_trampoline_add_prog(tr, node, cnt); if (err) -- 2.54.0 ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH bpf-next] bpf: Roll back freplace link state when bpf_arch_text_poke() fails 2026-09-25 4:35 ` [PATCH bpf-next] bpf: Roll back freplace link state when bpf_arch_text_poke() fails chenyuan_fl @ 2026-09-25 5:18 ` bot+bpf-ci 2026-09-25 6:05 ` Leon Hwang 1 sibling, 0 replies; 4+ messages in thread From: bot+bpf-ci @ 2026-09-25 5:18 UTC (permalink / raw) To: chenyuan_fl, bpf Cc: ast, daniel, andrii, eddyz87, memxor, jolsa, leon.hwang, linux-kernel, chenyuan, ast, andrii, daniel, martin.lau, eddyz87, yonghong.song, mason, ihor.solodrai [-- Attachment #1: Type: text/plain, Size: 1617 bytes --] > bpf: Roll back freplace link state when bpf_arch_text_poke() fails > > A freplace attach claims the target prog by bumping > tgt_prog->aux->freplace_link_cnt and setting tr->extension_prog. > bpf_arch_text_poke() then makes the extension take effect. If the > poke fails, the claims are never released: the attach unwinds > through bpf_link_cleanup(), which clears link->prog, so > bpf_trampoline_unlink_prog() never runs. > > Drop the link count under ext_mutex on the error path, and set > tr->extension_prog only after the poke succeeded. The count is > still bumped before the poke: it blocks prog_array updates while > the entry is patched. > > Fixes: d6083f040d5d ("bpf: Prevent tailcall infinite loop caused by freplace") > Suggested-by: Leon Hwang <leon.hwang@linux.dev> > Signed-off-by: Yuan Chen <chenyuan@kylinos.cn> The Fixes: tag points to d6083f040d5d, but should this be commit c43c348a8446 instead? Looking at the commit history, c43c348a8446 ("bpf: Keep target extended until its last freplace link detaches") introduced the freplace_link_cnt field and the bpf_freplace_link_tgt_prog() function that increments it. The bug being fixed here is that when bpf_freplace_link_tgt_prog() succeeds but bpf_arch_text_poke() subsequently fails, the incremented count is not rolled back. This exact code pattern was introduced by c43c348a8446, not d6083f040d5d. --- AI reviewed your patch. Please fix the bug or email reply why it's not a bug. See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md CI run summary: https://github.com/kernel-patches/bpf/actions/runs/36096074687 ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH bpf-next] bpf: Roll back freplace link state when bpf_arch_text_poke() fails 2026-09-25 4:35 ` [PATCH bpf-next] bpf: Roll back freplace link state when bpf_arch_text_poke() fails chenyuan_fl 2026-09-25 5:18 ` bot+bpf-ci @ 2026-09-25 6:05 ` Leon Hwang 2026-09-28 9:08 ` chenyuan 1 sibling, 1 reply; 4+ messages in thread From: Leon Hwang @ 2026-09-25 6:05 UTC (permalink / raw) To: chenyuan_fl, bpf Cc: ast, daniel, andrii, eddyz87, memxor, jolsa, linux-kernel, Yuan Chen On 25/9/26 12:35, chenyuan_fl@163.com wrote: > From: Yuan Chen <chenyuan@kylinos.cn> > > A freplace attach claims the target prog by bumping > tgt_prog->aux->freplace_link_cnt and setting tr->extension_prog. > bpf_arch_text_poke() then makes the extension take effect. If the > poke fails, the claims are never released: the attach unwinds > through bpf_link_cleanup(), which clears link->prog, so > bpf_trampoline_unlink_prog() never runs. > > Drop the link count under ext_mutex on the error path, and set > tr->extension_prog only after the poke succeeded. The count is > still bumped before the poke: it blocks prog_array updates while > the entry is patched. > > Fixes: d6083f040d5d ("bpf: Prevent tailcall infinite loop caused by freplace") Your commit msg also says the issue about tr->extension_prog. An extra Fixes tag for tr->extension_prog should be added. Fixes: be8704ff07d2 ("bpf: Introduce dynamic program extensions") The changes below lgtm: Acked-by: Leon Hwang <leon.hwang@linux.dev> Thanks, Leon > Suggested-by: Leon Hwang <leon.hwang@linux.dev> > Signed-off-by: Yuan Chen <chenyuan@kylinos.cn> > --- > kernel/bpf/trampoline.c | 13 ++++++++++--- > 1 file changed, 10 insertions(+), 3 deletions(-) > > diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c > index da85bd580ef0..bf4ab0ac264e 100644 > --- a/kernel/bpf/trampoline.c > +++ b/kernel/bpf/trampoline.c > @@ -973,10 +973,17 @@ static int __bpf_trampoline_link_prog(struct bpf_tramp_node *node, > err = bpf_freplace_link_tgt_prog(tgt_prog); > if (err) > return err; > + err = bpf_arch_text_poke(tr->func.addr, BPF_MOD_NOP, > + BPF_MOD_JUMP, NULL, > + node->link->prog->bpf_func); > + if (err) { > + /* Undo the claim from bpf_freplace_link_tgt_prog(). */ > + guard(mutex)(&tgt_prog->aux->ext_mutex); > + tgt_prog->aux->freplace_link_cnt--; > + return err; > + } > tr->extension_prog = node->link->prog; > - return bpf_arch_text_poke(tr->func.addr, BPF_MOD_NOP, > - BPF_MOD_JUMP, NULL, > - node->link->prog->bpf_func); > + return 0; > } > err = bpf_trampoline_add_prog(tr, node, cnt); > if (err) ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re:Re: [PATCH bpf-next] bpf: Roll back freplace link state when bpf_arch_text_poke() fails 2026-09-25 6:05 ` Leon Hwang @ 2026-09-28 9:08 ` chenyuan 0 siblings, 0 replies; 4+ messages in thread From: chenyuan @ 2026-09-28 9:08 UTC (permalink / raw) To: Leon Hwang Cc: bpf, ast, daniel, andrii, eddyz87, memxor, jolsa, linux-kernel, Yuan Chen Thanks for the review. v2 adds the be8704ff07d2 Fixes tag and collects your Ack. At 2026-09-25 14:05:59, "Leon Hwang" <leon.hwang@linux.dev> wrote: >On 25/9/26 12:35, chenyuan_fl@163.com wrote: >> From: Yuan Chen <chenyuan@kylinos.cn> >> >> A freplace attach claims the target prog by bumping >> tgt_prog->aux->freplace_link_cnt and setting tr->extension_prog. >> bpf_arch_text_poke() then makes the extension take effect. If the >> poke fails, the claims are never released: the attach unwinds >> through bpf_link_cleanup(), which clears link->prog, so >> bpf_trampoline_unlink_prog() never runs. >> >> Drop the link count under ext_mutex on the error path, and set >> tr->extension_prog only after the poke succeeded. The count is >> still bumped before the poke: it blocks prog_array updates while >> the entry is patched. >> >> Fixes: d6083f040d5d ("bpf: Prevent tailcall infinite loop caused by freplace") > >Your commit msg also says the issue about tr->extension_prog. > >An extra Fixes tag for tr->extension_prog should be added. > >Fixes: be8704ff07d2 ("bpf: Introduce dynamic program extensions") > >The changes below lgtm: > >Acked-by: Leon Hwang <leon.hwang@linux.dev> > >Thanks, >Leon > >> Suggested-by: Leon Hwang <leon.hwang@linux.dev> >> Signed-off-by: Yuan Chen <chenyuan@kylinos.cn> >> --- >> kernel/bpf/trampoline.c | 13 ++++++++++--- >> 1 file changed, 10 insertions(+), 3 deletions(-) >> >> diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c >> index da85bd580ef0..bf4ab0ac264e 100644 >> --- a/kernel/bpf/trampoline.c >> +++ b/kernel/bpf/trampoline.c >> @@ -973,10 +973,17 @@ static int __bpf_trampoline_link_prog(struct bpf_tramp_node *node, >> err = bpf_freplace_link_tgt_prog(tgt_prog); >> if (err) >> return err; >> + err = bpf_arch_text_poke(tr->func.addr, BPF_MOD_NOP, >> + BPF_MOD_JUMP, NULL, >> + node->link->prog->bpf_func); >> + if (err) { >> + /* Undo the claim from bpf_freplace_link_tgt_prog(). */ >> + guard(mutex)(&tgt_prog->aux->ext_mutex); >> + tgt_prog->aux->freplace_link_cnt--; >> + return err; >> + } >> tr->extension_prog = node->link->prog; >> - return bpf_arch_text_poke(tr->func.addr, BPF_MOD_NOP, >> - BPF_MOD_JUMP, NULL, >> - node->link->prog->bpf_func); >> + return 0; >> } >> err = bpf_trampoline_add_prog(tr, node, cnt); >> if (err) ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-28 9:09 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <4669addf.91e8.1a0d2da9b9c.Coremail.chenyuan_fl@163.com>
2026-09-25 4:35 ` [PATCH bpf-next] bpf: Roll back freplace link state when bpf_arch_text_poke() fails chenyuan_fl
2026-09-25 5:18 ` bot+bpf-ci
2026-09-25 6:05 ` Leon Hwang
2026-09-28 9:08 ` chenyuan
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®