Syzkaller reported follow WARNING:
WARNING: CPU: 0 PID: 17072 at bpf_tracing_link_release+0x88/0x90
Modules linked in:
CPU: 0 PID: 17072 Comm: syz-executor.1
RIP: 0010:bpf_tracing_link_release+0x88/0x90
Call Trace:
bpf_link_free+0x98/0xe0
bpf_link_put+0xd9/0xf0
bpf_link_release+0x26/0x30
__fput+0x219/0x560
task_work_run+0xbb/0x120
exit_to_user_mode_prepare+0x12f/0x140
syscall_exit_to_user_mode+0x23/0x80
entry_SYSCALL_64_after_hwframe+0x61/0xc6
This is simply caused by fault injection which makes memory allocation fail in
bpf_trampoline_unlink_prog->bpf_trampoline_update
Then bpf_trampoline_unlink_prog returns error and triggers WARN_ON in bpf_tracing_link_relaese.
At first I though it is a false positive report as bpf_trampoline_unlink_prog says
it should never fail. But actually it is possible.
When the bpf_trampoline_update is added at first, there is a "half page" optimization
to promise there is no memory allocation in the unlink path
But 88fd9e5352fe ("bpf: Refactor trampoline update code") added bpf_trampoline_get_progs,
which broke this.
Then the "half page" part was also removed in e21aa341785c ("bpf: Fix fexit trampoline.").
Besides, as I know the relied ftrace interface is not promised to success as well.
In bpf_trampoline_link_prog it will handle these error, but unlink_prog
just reports the warning once and continue to put tr_link->trampoline and link->prog.
Sorry for that I have not fully tested this but I guess this could cause some bad
consequence such as memory leak or null pointer reference.
Anyway, now the interface to detach bpf link is not 100% safe, and because of
the complex logic in bpf_trampoline_update, I think this can't be avoided.
Because now these release ops return void, we cannot just simply keep these resources
and have another try.
I just want to know does anyone has plan or advice to handle these error scenarios gracefully?
Thanks for your help!
Best,
Chen
