Re: [PATCH bpf-next v2 1/2] bpf: Fix abuse of kprobe_write_ctx via freplace

[Jiri Olsa]

On Thu, Mar 26, 2026 at 10:17:17PM +0800, Leon Hwang wrote:
> uprobe programs are allowed to modify struct pt_regs.
> 
> Since the actual program type of uprobe is KPROBE, it can be abused to
> modify struct pt_regs via kprobe+freplace when the kprobe attaches to
> kernel functions.
> 
> For example,
> 
> SEC("?kprobe")
> int kprobe(struct pt_regs *regs)
> {
>       return 0;
> }
> 
> SEC("?freplace")
> int freplace_kprobe(struct pt_regs *regs)
> {
>       regs->di = 0;
>       return 0;
> }
> 
> freplace_kprobe prog will attach to kprobe prog.
> kprobe prog will attach to a kernel function.
> 
> Without this patch, when the kernel function runs, its first arg will
> always be set as 0 via the freplace_kprobe prog.
> 
> To fix the abuse of kprobe_write_ctx=true via kprobe+freplace, disallow
> attaching freplace programs on kprobe programs with different
> kprobe_write_ctx values.
> 
> Fixes: 7384893d970e ("bpf: Allow uprobe program to change context registers")
> Signed-off-by: Leon Hwang <leon.hw...@linux.dev>
> ---
>  kernel/bpf/syscall.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 51ade3cde8bb..1dd2ea076d8b 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3733,6 +3733,11 @@ static int bpf_tracing_prog_attach(struct bpf_prog 
> *prog,
>               tr = prog->aux->dst_trampoline;
>               tgt_prog = prog->aux->dst_prog;
>       }

could you please put some comment in here explaining the check, with that

Acked-by: Jiri Olsa <jo...@kernel.org>

thanks,
jirka


> +     if (prog->type == BPF_PROG_TYPE_EXT &&
> +         prog->aux->kprobe_write_ctx != tgt_prog->aux->kprobe_write_ctx) {
> +             err = -EINVAL;
> +             goto out_unlock;
> +     }
>  
>       err = bpf_link_prime(&link->link.link, &link_primer);
>       if (err)
> -- 
> 2.53.0
>