Re: [PATCH bpf-next] bpf:syscall: Log error code on trampoline unlink failure
From: xu.xin16
Date: Thu Jul 16 2026 - 02:27:42 EST
> > Well, the crash may happen when the kernel is booting, or too hard to reproduce,
> > in which case, bpftrace does not work.
>
>
> Do you enable kernel.panic_on_warn sysctl?
>
> If it's not enabled, the kernel won't crash, I think.
I'd like to clarify that the panic in our case is not triggered by the WARN itself.
Instead, the real crash is a use‑after‑free (UAF) that happens when one CPU is
executing a trampoline while another CPU is concurrently freeing it. This results
in an illegal instruction (or page fault) at the PC, which is fatal and will panic
the kernel regardless of panic_on_warn – because it's an Oops with Fatal exception
in interrupt.