[PATCH bpf-next v4] bpf: log error code on trampoline unlink failure

[PATCH bpf-next v4] bpf: log error code on trampoline unlink failure

[xu.xin16]

From: Xu Xin <xu.xin16@zte.com.cn>

Replace silent WARN_ON_ONCE with WARN_ONCE that prints the actual error
code from bpf_trampoline_unlink_prog(). This aids debugging of race
conditions during link teardown, while keeping the warning rate limited
to avoid log flooding.

This will be very helpful for speeding up trouble-shooting of some crash
UAF due to bpf_trampoline_unlink_prog failures.

No change to unlink behavior.

Signed-off-by: Xu Xin <xu.xin16@zte.com.cn>
Acked-by: Leon Hwang <leon.hwang@linux.dev>
---
Change log:
- Small fixes according to the v3 disccusion:
  https://lore.kernel.org/all/82926caa-e16a-457a-8d75-61dfc8dac102@linux.dev/

 kernel/bpf/syscall.c    |  8 +++++---
 kernel/bpf/trampoline.c | 12 ++++++++----
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 6db306d23b47..52c57f8beb37 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3626,10 +3626,12 @@ static void bpf_tracing_link_release(struct bpf_link *link)
 {
 	struct bpf_tracing_link *tr_link =
 		container_of(link, struct bpf_tracing_link, link.link);
+	int err;

-	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link.node,
-						tr_link->trampoline,
-						tr_link->tgt_prog));
+	err = bpf_trampoline_unlink_prog(&tr_link->link.node,
+					tr_link->trampoline,
+					tr_link->tgt_prog);
+	WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);

 	bpf_trampoline_put(tr_link->trampoline);

diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index 1a721fc4bef5..49dceea3d51e 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -997,12 +997,15 @@ static void bpf_shim_tramp_link_release(struct bpf_link *link)
 {
 	struct bpf_shim_tramp_link *shim_link =
 		container_of(link, struct bpf_shim_tramp_link, link.link);
+	int err;

 	/* paired with 'shim_link->trampoline = tr' in bpf_trampoline_link_cgroup_shim */
 	if (!shim_link->trampoline)
 		return;

-	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link.node, shim_link->trampoline, NULL));
+	err = bpf_trampoline_unlink_prog(&shim_link->link.node, shim_link->trampoline, NULL);
+	WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);
+
 	bpf_trampoline_put(shim_link->trampoline);
 }

@@ -1712,15 +1715,16 @@ int bpf_trampoline_multi_detach(struct bpf_prog *prog, struct bpf_tracing_multi_
 {
 	struct bpf_tracing_multi_data *data = &link->data;
 	struct bpf_tracing_multi_node *mnode;
-	int i;
+	int i, err;

 	trampoline_lock_all();

 	for_each_mnode(mnode, link) {
 		data->entry = &mnode->entry;
 		bpf_trampoline_multi_attach_init(mnode->trampoline);
-		WARN_ON_ONCE(__bpf_trampoline_unlink_prog(&mnode->node, mnode->trampoline,
-					NULL, &trampoline_multi_ops, data));
+		err = __bpf_trampoline_unlink_prog(&mnode->node, mnode->trampoline, NULL,
+					&trampoline_multi_ops, data);
+		WARN_ONCE(err, "__bpf_trampoline_unlink_prog returns error: %d\n", err);
 	}

 	if (ftrace_hash_count(data->unreg))
-- 
2.25.1

Re: [PATCH bpf-next v4] bpf: log error code on trampoline unlink failure

[Emil Tsalapatis]

On Wed Jul 29, 2026 at 2:11 AM EDT, xu.xin16 wrote:
> From: Xu Xin <xu.xin16@zte.com.cn>
>
> Replace silent WARN_ON_ONCE with WARN_ONCE that prints the actual error
> code from bpf_trampoline_unlink_prog(). This aids debugging of race
> conditions during link teardown, while keeping the warning rate limited
> to avoid log flooding.
>
> This will be very helpful for speeding up trouble-shooting of some crash
> UAF due to bpf_trampoline_unlink_prog failures.
>
> No change to unlink behavior.
>
> Signed-off-by: Xu Xin <xu.xin16@zte.com.cn>
> Acked-by: Leon Hwang <leon.hwang@linux.dev>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

The Sashiko concern seems valid, please let me know if you are
planning on looking into it otherwise I can take a look.

> ---
> Change log:
> - Small fixes according to the v3 disccusion:
>   https://lore.kernel.org/all/82926caa-e16a-457a-8d75-61dfc8dac102@linux.dev/
>
>  kernel/bpf/syscall.c    |  8 +++++---
>  kernel/bpf/trampoline.c | 12 ++++++++----
>  2 files changed, 13 insertions(+), 7 deletions(-)
>
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 6db306d23b47..52c57f8beb37 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3626,10 +3626,12 @@ static void bpf_tracing_link_release(struct bpf_link *link)
>  {
>  	struct bpf_tracing_link *tr_link =
>  		container_of(link, struct bpf_tracing_link, link.link);
> +	int err;
>
> -	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link.node,
> -						tr_link->trampoline,
> -						tr_link->tgt_prog));
> +	err = bpf_trampoline_unlink_prog(&tr_link->link.node,
> +					tr_link->trampoline,
> +					tr_link->tgt_prog);
> +	WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);
>
>  	bpf_trampoline_put(tr_link->trampoline);
>
> diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> index 1a721fc4bef5..49dceea3d51e 100644
> --- a/kernel/bpf/trampoline.c
> +++ b/kernel/bpf/trampoline.c
> @@ -997,12 +997,15 @@ static void bpf_shim_tramp_link_release(struct bpf_link *link)
>  {
>  	struct bpf_shim_tramp_link *shim_link =
>  		container_of(link, struct bpf_shim_tramp_link, link.link);
> +	int err;
>
>  	/* paired with 'shim_link->trampoline = tr' in bpf_trampoline_link_cgroup_shim */
>  	if (!shim_link->trampoline)
>  		return;
>
> -	WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link.node, shim_link->trampoline, NULL));
> +	err = bpf_trampoline_unlink_prog(&shim_link->link.node, shim_link->trampoline, NULL);
> +	WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);
> +
>  	bpf_trampoline_put(shim_link->trampoline);
>  }
>
> @@ -1712,15 +1715,16 @@ int bpf_trampoline_multi_detach(struct bpf_prog *prog, struct bpf_tracing_multi_
>  {
>  	struct bpf_tracing_multi_data *data = &link->data;
>  	struct bpf_tracing_multi_node *mnode;
> -	int i;
> +	int i, err;
>
>  	trampoline_lock_all();
>
>  	for_each_mnode(mnode, link) {
>  		data->entry = &mnode->entry;
>  		bpf_trampoline_multi_attach_init(mnode->trampoline);
> -		WARN_ON_ONCE(__bpf_trampoline_unlink_prog(&mnode->node, mnode->trampoline,
> -					NULL, &trampoline_multi_ops, data));
> +		err = __bpf_trampoline_unlink_prog(&mnode->node, mnode->trampoline, NULL,
> +					&trampoline_multi_ops, data);
> +		WARN_ONCE(err, "__bpf_trampoline_unlink_prog returns error: %d\n", err);
>  	}
>
>  	if (ftrace_hash_count(data->unreg))

Re: [PATCH bpf-next v4] bpf: log error code on trampoline unlink failure

[xu.xin16]

> >
> > Replace silent WARN_ON_ONCE with WARN_ONCE that prints the actual error
> > code from bpf_trampoline_unlink_prog(). This aids debugging of race
> > conditions during link teardown, while keeping the warning rate limited
> > to avoid log flooding.
> >
> > This will be very helpful for speeding up trouble-shooting of some crash
> > UAF due to bpf_trampoline_unlink_prog failures.
> >
> > No change to unlink behavior.
> >
> > Signed-off-by: Xu Xin <xu.xin16@zte.com.cn>
> > Acked-by: Leon Hwang <leon.hwang@linux.dev>
> 
> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
> 
> The Sashiko concern seems valid, please let me know if you are
> planning on looking into it otherwise I can take a look.

It was discussed in previous thread, but the conclusion seems to be "let it go".

Not sure how to deal with it. Do you have any idea ?

答复: [PATCH bpf-next v4] bpf: log error code on trampoline unlink failure

[xu.xin16]

The previous discussion link: https://lore.kernel.org/all/7e023c28-abe5-25a6-150d-ff8a782992de@huawei.com/

Re: [PATCH bpf-next v4] bpf: log error code on trampoline unlink failure

[Andrii Nakryiko]

On Tue, Jul 28, 2026 at 11:12 PM <xu.xin16@zte.com.cn> wrote:
>
> From: Xu Xin <xu.xin16@zte.com.cn>
>
> Replace silent WARN_ON_ONCE with WARN_ONCE that prints the actual error
> code from bpf_trampoline_unlink_prog(). This aids debugging of race
> conditions during link teardown, while keeping the warning rate limited
> to avoid log flooding.
>
> This will be very helpful for speeding up trouble-shooting of some crash
> UAF due to bpf_trampoline_unlink_prog failures.
>
> No change to unlink behavior.
>
> Signed-off-by: Xu Xin <xu.xin16@zte.com.cn>
> Acked-by: Leon Hwang <leon.hwang@linux.dev>
> ---
> Change log:
> - Small fixes according to the v3 disccusion:
>   https://lore.kernel.org/all/82926caa-e16a-457a-8d75-61dfc8dac102@linux.dev/
>
>  kernel/bpf/syscall.c    |  8 +++++---
>  kernel/bpf/trampoline.c | 12 ++++++++----
>  2 files changed, 13 insertions(+), 7 deletions(-)
>
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 6db306d23b47..52c57f8beb37 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3626,10 +3626,12 @@ static void bpf_tracing_link_release(struct bpf_link *link)
>  {
>         struct bpf_tracing_link *tr_link =
>                 container_of(link, struct bpf_tracing_link, link.link);
> +       int err;
>
> -       WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link.node,
> -                                               tr_link->trampoline,
> -                                               tr_link->tgt_prog));
> +       err = bpf_trampoline_unlink_prog(&tr_link->link.node,
> +                                       tr_link->trampoline,
> +                                       tr_link->tgt_prog);
> +       WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);
>
>         bpf_trampoline_put(tr_link->trampoline);
>
> diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> index 1a721fc4bef5..49dceea3d51e 100644
> --- a/kernel/bpf/trampoline.c
> +++ b/kernel/bpf/trampoline.c
> @@ -997,12 +997,15 @@ static void bpf_shim_tramp_link_release(struct bpf_link *link)
>  {
>         struct bpf_shim_tramp_link *shim_link =
>                 container_of(link, struct bpf_shim_tramp_link, link.link);
> +       int err;
>
>         /* paired with 'shim_link->trampoline = tr' in bpf_trampoline_link_cgroup_shim */
>         if (!shim_link->trampoline)
>                 return;
>
> -       WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link.node, shim_link->trampoline, NULL));
> +       err = bpf_trampoline_unlink_prog(&shim_link->link.node, shim_link->trampoline, NULL);
> +       WARN_ONCE(err, "bpf_trampoline_unlink_prog returns error: %d\n", err);
> +

I changed wording to "bpf_trampoline_unlink_prog failed: %d\n" (in all
three places), applied to bpf-next

>         bpf_trampoline_put(shim_link->trampoline);
>  }
>
> @@ -1712,15 +1715,16 @@ int bpf_trampoline_multi_detach(struct bpf_prog *prog, struct bpf_tracing_multi_
>  {
>         struct bpf_tracing_multi_data *data = &link->data;
>         struct bpf_tracing_multi_node *mnode;
> -       int i;
> +       int i, err;
>
>         trampoline_lock_all();
>
>         for_each_mnode(mnode, link) {
>                 data->entry = &mnode->entry;
>                 bpf_trampoline_multi_attach_init(mnode->trampoline);
> -               WARN_ON_ONCE(__bpf_trampoline_unlink_prog(&mnode->node, mnode->trampoline,
> -                                       NULL, &trampoline_multi_ops, data));
> +               err = __bpf_trampoline_unlink_prog(&mnode->node, mnode->trampoline, NULL,
> +                                       &trampoline_multi_ops, data);
> +               WARN_ONCE(err, "__bpf_trampoline_unlink_prog returns error: %d\n", err);
>         }
>
>         if (ftrace_hash_count(data->unreg))
> --
> 2.25.1