Re: [PATCH bpf-next 1/2] bpf: Keep target extended until its last freplace link detaches

From: bot+bpf-ci

Date: Wed Sep 23 2026 - 06:13:35 EST


> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index e7c5e203eddd..d5a20974a8aa 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h

[ ... ]

> diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
> index 0ce26b538075..0fe9afd4a591 100644
> --- a/kernel/bpf/arraymap.c
> +++ b/kernel/bpf/arraymap.c

[ ... ]

> diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> index 90b70ea0d370..f6e6533deb0b 100644
> --- a/kernel/bpf/trampoline.c
> +++ b/kernel/bpf/trampoline.c
> @@ -843,7 +843,7 @@ static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog)
> }
> }
>
> -static int bpf_freplace_check_tgt_prog(struct bpf_prog *tgt_prog)
> +static int bpf_freplace_link_tgt_prog(struct bpf_prog *tgt_prog)
> {
> struct bpf_prog_aux *aux = tgt_prog->aux;
>
> @@ -857,7 +857,7 @@ static int bpf_freplace_check_tgt_prog(struct bpf_prog *tgt_prog)
> */
> return -EBUSY;
>
> - aux->is_extended = true;
> + aux->freplace_link_cnt++;
> return 0;
> }

This isn't a bug, but would it be worth keeping this fix minimal for
backporting and doing the rename as a separate follow-up patch?

The rename from bpf_freplace_check_tgt_prog() to
bpf_freplace_link_tgt_prog() is independent of the counting fix: the
only functional change in this helper is 'aux->is_extended = true'
becoming 'aux->freplace_link_cnt++', which does not require a new name.

Since the patch carries a Fixes: tag for d6083f040d5d, it is a
stable-backport candidate, and folding a rename into it adds conflict
surface for no behavioural reason.

If the rename stays, does something like bpf_freplace_get_tgt_prog() or
bpf_freplace_reserve_tgt_prog() read less ambiguously next to
__bpf_trampoline_link_prog(), where 'link' means 'attach a program to a
trampoline'?

>
> @@ -970,7 +970,7 @@ static int __bpf_trampoline_link_prog(struct bpf_tramp_node *node,
> /* Cannot attach extension if fentry/fexit are in use. */
> if (cnt)
> return -EBUSY;
> - err = bpf_freplace_check_tgt_prog(tgt_prog);
> + err = bpf_freplace_link_tgt_prog(tgt_prog);
> if (err)
> return err;
> tr->extension_prog = node->link->prog;

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/35842777159