Hello:
This series was applied to bpf/bpf-next.git (master)
by Kumar Kartikeya Dwivedi <[email protected]>:
On Wed, 22 Jul 2026 23:19:07 +0800 you wrote:
> The trampoline could be corrupted by the blindly
> 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier.
>
> 1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became
> 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the
> trampoline would poke the target prog's nop insn using jmp insn instead
> of call insn.
> 2. Another fexit loaded with the same tail_call_reachable prog target.
> 'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'.
> 3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in
> 'tr->flags', the trampoline will fail to restore the prog's nop insn
> using call insn.
>
> [...]
Here is the summary with links:
- [bpf-next,v2,1/2] bpf: Fix WARNING in bpf_tracing_link_release
https://git.kernel.org/bpf/bpf-next/c/61aaa8782bec
- [bpf-next,v2,2/2] selftests/bpf: Verify no warning when close fexit link
https://git.kernel.org/bpf/bpf-next/c/09e074666b7d
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
