Re: [PATCH bpf v4 2/3] bpf: Skip detached progs in trampoline images that are still in use

[Alexei Starovoitov]

On Fri, Sep 25, 2026 at 10:47 AM bot+bpf-ci@xxxxxxxxxx <bot+bpf-ci@xxxxxxxxxx> wrote:
>> +	/* nops for move_imm+jirl, patched to skip this prog when it is detached */
>> +	for (i = 0; i < LOONGARCH_LONG_JUMP_NINSNS; i++)
>> +		emit_insn(ctx, nop);
>
> Can a task preempted inside the skip sled resume into half of the new jump
> sequence and jump to a garbage address?

[...]

> Could the LoongArch skip site use a single instruction instead? For
> example, a 'b' to the skip target, which is always within the +/-128MB
> range of the same image, patched from nop to 'b'. The rest of the sled
> would then be unnecessary.

Seems like a real bug. Same issue on riscv.

ip_after_call was patched in bpf_tramp_image_put() when the image was
already unreachable. Now bpf_trampoline_remove_prog() patches cur_image
before bpf_trampoline_update() replaces it, so every call of the traced
function goes through the sled while it is rewritten. stop_machine
doesn't help the task that it preempted in the middle of the sled.

Pls fix and respin.
Everything else looks good.

pw-bot: cr