Re: [PATCH bpf-next] bpf: Roll back freplace link state when bpf_arch_text_poke() fails

[bot+bpf-ci]

> bpf: Roll back freplace link state when bpf_arch_text_poke() fails
>
> A freplace attach claims the target prog by bumping
> tgt_prog->aux->freplace_link_cnt and setting tr->extension_prog.
> bpf_arch_text_poke() then makes the extension take effect.  If the
> poke fails, the claims are never released: the attach unwinds
> through bpf_link_cleanup(), which clears link->prog, so
> bpf_trampoline_unlink_prog() never runs.
>
> Drop the link count under ext_mutex on the error path, and set
> tr->extension_prog only after the poke succeeded.  The count is
> still bumped before the poke: it blocks prog_array updates while
> the entry is patched.
>
> Fixes: d6083f040d5d ("bpf: Prevent tailcall infinite loop caused by freplace")
> Suggested-by: Leon Hwang <leon.hwang@xxxxxxxxx>
> Signed-off-by: Yuan Chen <chenyuan@xxxxxxxxxx>

The Fixes: tag points to d6083f040d5d, but should this be commit
c43c348a8446 instead?

Looking at the commit history, c43c348a8446 ("bpf: Keep target extended
until its last freplace link detaches") introduced the freplace_link_cnt
field and the bpf_freplace_link_tgt_prog() function that increments it.

The bug being fixed here is that when bpf_freplace_link_tgt_prog() succeeds
but bpf_arch_text_poke() subsequently fails, the incremented count is not
rolled back. This exact code pattern was introduced by c43c348a8446, not
d6083f040d5d.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/36096074687