This fixes a use-after-free when using subprogs and tailcalls and adds a test case to trigger the use-after-free. John Fastabend (2): bpf: track subprog poke correctly, fix use-after-free bpf: selftest to verify mixing bpf2bpf calls and tailcalls with insn patch arch/x86/net/bpf_jit_comp.c | 4 ++ include/linux/bpf.h | 1 + kernel/bpf/core.c | 7 +++- kernel/bpf/verifier.c | 39 ++++--------------- .../selftests/bpf/prog_tests/tailcalls.c | 36 ++++++++++++----- .../selftests/bpf/progs/tailcall_bpf2bpf4.c | 21 +++++++++- 6 files changed, 64 insertions(+), 44 deletions(-) -- 2.25.1