Subject bpf: Fix use-after-free of progs detached from busy trampolines
Author florent.revest@linux.dev
Date 2026-09-26 13:55:58 +0000 UTC
Version
Cc agordeev@linux.ibm.com alex@ghiti.fr andrii@kernel.org aou@eecs.berkeley.edu ast@kernel.org bjorn@kernel.org borntraeger@linux.ibm.com bp@alien8.de bpf@vger.kernel.org catalin.marinas@arm.com chenhuacai@kernel.org chleroy@kernel.org daniel@iogearbox.net dave.hansen@linux.intel.com eddyz87@gmail.com emil@etsalapatis.com florent.revest@linux.dev gor@linux.ibm.com hbathini@linux.ibm.com hca@linux.ibm.com hengqi.chen@gmail.com hpa@zytor.com ihor.solodrai@linux.dev iii@linux.ibm.com john.fastabend@gmail.com jolsa@kernel.org kernel@xen0n.name kpsingh@kernel.org leon.hwang@linux.dev linux-arm-kernel@lists.infradead.org linux-kernel@vger.kernel.org linux-kselftest@vger.kernel.org linux-riscv@lists.infradead.org linux-s390@vger.kernel.org linuxppc-dev@lists.ozlabs.org loongarch@lists.linux.dev maddy@linux.ibm.com mark.rutland@arm.com martin.lau@linux.dev memxor@gmail.com mingo@redhat.com mpe@ellerman.id.au naveen@kernel.org npiggin@gmail.com palmer@dabbelt.com paulmck@kernel.org pjw@kernel.org pulehui@huawei.com puranjay@kernel.org rhkrqnwk98@gmail.com
Patches (3)
Name Content [All]
[PATCH bpf v5 1/3] bpf: Wait for an RCU tasks grace period before freeing trampoline progs [Body]
[PATCH bpf v5 2/3] bpf: Skip detached progs in trampoline images that are still in use [Body]
[PATCH bpf v5 3/3] selftests/bpf: Detach a trampoline prog while a task sleeps before it [Body]
Series Summary
Passed
✓ All tests passed. No findings.
Sessions
Session 2026-09-26
Passed
ID (for dev) 56780d7c-a985-4586-921f-f88c2c8d8a80
Status finished
Triaged OK [Log] [Trajectory]
Execution Log [Link]
Test Base Patched Verdict
[KASAN] Build Base ab39974240a0cff765f3bb9cce81d8001ffdb144 [Config] passed [Log]
[KASAN] Boot test: Base ab39974240a0cff765f3bb9cce81d8001ffdb144 [Config] passed [Log]
[KASAN] Build Patched ab39974240a0cff765f3bb9cce81d8001ffdb144 [Config] [patched] passed [Log]
[KASAN] Boot test: Patched ab39974240a0cff765f3bb9cce81d8001ffdb144 [Config] [patched] passed [Log]
[KASAN] Fuzz ab39974240a0cff765f3bb9cce81d8001ffdb144 [Config] ab39974240a0cff765f3bb9cce81d8001ffdb144 [Config] [patched] passed [Log] [Artifacts]