Based on Martin KaFai Lau's suggestions, I have created a simple patch. The root cause of this bug is that when `bpf_link_put` reduces the refcount of `shim_link->link.link` to zero, the resource is considered released but may still be referenced via `tr->progs_hlist` in `cgroup_shim_find`. The actual cleanup of `tr->progs_hlist` in `bpf_shim_tramp_link_release` is deferred. During this window, another process can cause a use-after-free via `bpf_trampoline_link_cgroup_shim`. To fix this: Add an atomic non-zero check in `bpf_trampoline_link_cgroup_shim`. Only increment the refcount if it is not already zero. Optimized testing: I used a non-rigorous method to verify the fix by adding a delay in `bpf_shim_tramp_link_release` to make the bug easier to trigger: static void bpf_shim_tramp_link_release(struct bpf_link *link) { ... if (!shim_link->trampoline) return; + msleep(100); WARN_ON_ONCE(bpf_trampoline_unlink_prog(&shim_link->link, shim_link->trampoline, NULL)); bpf_trampoline_put(shim_link->trampoline); } Before the patch, running a PoC easily reproduced the crash(almost 100%) with a call trace similar to KaiyanM's report. After the patch, the bug no longer occurs even after millions of iterations. Signed-off-by: xulang --- kernel/bpf/trampoline.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c index 976d89011b15..ac99725403ad 100644 --- a/kernel/bpf/trampoline.c +++ b/kernel/bpf/trampoline.c @@ -779,6 +779,7 @@ int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog, struct bpf_shim_tramp_link *shim_link = NULL; struct bpf_attach_target_info tgt_info = {}; struct bpf_trampoline *tr; + struct bpf_link *link; bpf_func_t bpf_func; u64 key; int err; @@ -801,12 +802,13 @@ int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog, shim_link = cgroup_shim_find(tr, bpf_func); if (shim_link) { - /* Reusing existing shim attached by the other program. */ - bpf_link_inc(&shim_link->link.link); - - mutex_unlock(&tr->mutex); - bpf_trampoline_put(tr); /* bpf_trampoline_get above */ - return 0; + link = &shim_link->link.link; + if (link == bpf_link_inc_not_zero(link)) { + /* Reusing existing shim attached by the other program. */ + mutex_unlock(&tr->mutex); + bpf_trampoline_put(tr); /* bpf_trampoline_get above */ + return 0; + } } /* Allocate and install new shim. */ -- 2.51.0