Re: [PATCH bpf-next v5 0/2] bpf: Fix trampoline image UAF on multi detach failure

[Leon Hwang]

On 11/8/26 10:46, Hui Zhu wrote:
> From: Hui Zhu <zhuhui@xxxxxxxxxx>
> 
> This series fixes a UAF in bpf_trampoline_multi_attach_free() where
> old_image is freed while ftrace still calls into it, and makes
> bpf_trampoline_multi_detach() return void as suggested by Jiri Olsa.
> 
> Patch 1 fixes the UAF.  Patch 2 is an independent cleanup that
> changes the return type to void and drops the WARN_ON_ONCE at the
> call site.


The UAF issue was reported by Sashiko when reviewing "bpf: Add
tracing_multi link support for bpf progs" [1].

The fix and the cleanup look good to me.

Acked-by: Leon Hwang <leon.hwang@xxxxxxxxx>

[1]
https://sashiko.dev/#/message/20260809153308.5331D1F000E9%40smtp.kernel.org

> [...]