Re: [PATCH bpf] bpf: Keep progs alive until the trampoline image calling them is freed

[Junseo Lim]

On Wed, Aug 19, 2026 at 12:22:50PM +0000, Florent Revest (Anthropic) wrote:
> bpf_tramp_image_put() makes sure a trampoline image is not freed while
> a task may still be running in it (call_rcu_tasks() + im->pcref), but
> nothing similar is done for the progs called by that image. Since
> commit e21aa341785c ("bpf: Fix fexit trampoline."), detach patches the
> return path so that a task still in the original function skips the
> fexit progs when it comes back, and counts on the prog's own RCU flavor
> to cover a task that is inside a prog. On that basis the last prog
> reference is dropped right away and the prog is freed after a single
> RCU / RCU tasks trace grace period.
>
> [...] 
> 
> Fix it by having the image take a reference on every prog it calls, in
> bpf_tramp_image_alloc(), and drop them in bpf_tramp_image_free(). A
> detached prog now stays loaded until the old image is gone, which
> reverts a deliberate choice of commit e21aa341785c ("bpf: Fix fexit
> trampoline."). Detached fexit progs still stop being called right away
> since the return path is patched.

This appears to be the same issue addressed by my earlier patch [1].

I think the flexible-array approach here is cleaner, so I'm fine with this
version going forward. Could you please carry the original Reported-by tag?

Reported-by: Sechang Lim <rhkrqnwk98@xxxxxxxxx>

[1] https://lore.kernel.org/bpf/20260815071927.147049-1-zirajs7@xxxxxxxxx/T/