This fixes a use-after-free when using subprogs and tailcalls and adds a test case to trigger the use-after-free. v2: original patch missed fixups needed in out label as Daniel caught John Fastabend (2): bpf: track subprog poke correctly, fix use-after-free bpf: selftest to verify mixing bpf2bpf calls and tailcalls with insn patch arch/x86/net/bpf_jit_comp.c | 4 ++ include/linux/bpf.h | 1 + kernel/bpf/core.c | 7 ++- kernel/bpf/verifier.c | 45 ++++--------------- .../selftests/bpf/prog_tests/tailcalls.c | 36 ++++++++++----- .../selftests/bpf/progs/tailcall_bpf2bpf4.c | 21 ++++++++- 6 files changed, 65 insertions(+), 49 deletions(-) -- 2.17.1