Re: [syzbot] [perf?] KASAN: slab-use-after-free Read in __uprobe_unregister

[Oleg Nesterov]

On 08/10, syzbot wrote:
>
> syzbot found the following issue on:
>
> HEAD commit:    6a0e38264012 Merge tag 'for-6.11-rc2-tag' of git://git.ker..
> git tree:       upstream

#syz test: upstream 6a0e38264012

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index cd098846e251..5d9c96c69733 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -3485,17 +3485,19 @@ int bpf_uprobe_multi_link_attach(const union bpf_attr 
*attr, struct bpf_prog *pr
                                             uprobes[i].ref_ctr_offset,
                                             &uprobes[i].consumer);
                if (err) {
-                       bpf_uprobe_unregister(&path, uprobes, i);
-                       goto error_free;
+                       goto error_unregister;
                }
        }
 
        err = bpf_link_prime(&link->link, &link_primer);
        if (err)
-               goto error_free;
+               goto error_unregister;
 
        return bpf_link_settle(&link_primer);
 
+error_unregister:
+       bpf_uprobe_unregister(&path, uprobes, i);
+
 error_free:
        kvfree(uprobes);
        kfree(link);