Re: [PATCH bpf-next 1/6] bpf: Add syscall common attrs support for link_create

[Leon Hwang]

On 2026/10/17 22:39, sashiko-...@kernel.org wrote:

[...]

>>  out:
>> -    if (ret < 0)
>> +    /* preserve original error even if log finalization is successful */
>> +    err = bpf_log_attr_finalize(&attr_log, log);
>> +    if (err)
>> +            ret = err;
>> +
>> +    kfree(log);
>> +
>> +    if (ret < 0 && prog)
>>              bpf_prog_put(prog);
>>      return ret;
>>  }
> 
> [Severity: Critical]
> Can this underflow the refcount on prog and leak the newly installed link
> file descriptor if bpf_log_attr_finalize() fails after link attachment
> succeeds?

Correct.

To avoid such prog leak, I'd like to report the log_true_size twice.

ret = bpf_log_attr_report_size(&attr_log, 0);
if (ret)
        goto out;

switch (prog->type) {
        /* ... */
}

out:
if (ret) {
        int err =  bpf_log_attr_finalize(&attr_log, log);

        ret = err ? err : ret;
}

if (ret < 0 && prog)
        bpf_prog_put(prog);

kfree(log);
return ret;

Thanks,
Leon

> [...]