bpf: Fix a potential use-after-free of BTF object
authorAnton Protopopov <a.s.protopopov@gmail.com>
Mon, 9 Feb 2026 13:29:04 +0000 (13:29 +0000)
committerAlexei Starovoitov <ast@kernel.org>
Fri, 13 Feb 2026 22:14:27 +0000 (14:14 -0800)
commitccd2d799ed4467c07f5ee18c2f5c59bcc990822c
tree1b5354250922f6ba02ba50dc7c81dfc79bb7935a
parent04999b99e81eaa7b6223ec1c03af3bcb4ac57aaa
bpf: Fix a potential use-after-free of BTF object

Refcounting in the check_pseudo_btf_id() function is incorrect:
the __check_pseudo_btf_id() function might get called with a zero
refcounted btf. Fix this, and patch related code accordingly.

v3: rephrase a comment (AI)
v2: fix a refcount leak introduced in v1 (AI)

Reported-by: syzbot+5a0f1995634f7c1dadbf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5a0f1995634f7c1dadbf
Fixes: 76145f725532 ("bpf: Refactor check_pseudo_btf_id")
Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
Link: https://lore.kernel.org/r/20260209132904.63908-1-a.s.protopopov@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/verifier.c