Re: [PATCH bpf] bpf: Fix program BTF use-after-free in sleepable programs

[sun jian]

On Tue, Sep 1, 2026 at 10:06 AM Sanghyun Park
<sanghyun.park.cnu@xxxxxxxxx> wrote:
>
> Object kfunc calls embed metadata owned by the program BTF. A sleepable
> program can remain active under Tasks Trace RCU after its last reference is
> dropped, while program teardown releases the BTF through ordinary RCU. The
> invocation can then dereference freed metadata in bpf_obj_new().
>
> Move btf_put() into __bpf_prog_put_rcu(), the callback that frees the
> program. When teardown is deferred, that callback runs after the program's
> own grace period (Tasks Trace RCU for sleepable programs and ordinary RCU
> otherwise), so the BTF outlives every active invocation. The non-deferred
> path invokes the callback synchronously, so load-error cleanup stays direct.
>
> Fixes: 958cf2e273f0 ("bpf: Introduce bpf_obj_new")
> Signed-off-by: Sanghyun Park <sanghyun.park.cnu@xxxxxxxxx>
> ---
>  kernel/bpf/syscall.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 6db306d23b479f..3b6cf93c43c4d6 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -2438,6 +2438,7 @@ static void __bpf_prog_put_rcu(struct rcu_head *rcu)
>  {
>         struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);
>
> +       btf_put(aux->btf);
>         kvfree(aux->func_info);
>         kfree(aux->func_info_aux);
>         free_uid(aux->user);
> @@ -2448,7 +2449,6 @@ static void __bpf_prog_put_rcu(struct rcu_head *rcu)
>  static void __bpf_prog_put_noref(struct bpf_prog *prog, bool deferred)
>  {
>         bpf_prog_kallsyms_del_all(prog);
> -       btf_put(prog->aux->btf);
>         module_put(prog->aux->mod);
>         kvfree(prog->aux->jited_linfo);
>         kvfree(prog->aux->linfo);
> --
> 2.48.1
>
Reviewed-by: Sun Jian <sun.jian.kdev@xxxxxxxxx>