Re: [PATCH bpf v6 1/4] bpf: Fix potential UAF in bpf_netns_link_update_prog

[Pu Lehui <pulehui@huawei.com>]

On 2026/7/28 7:01, Andrii Nakryiko wrote:
> On Wed, Jul 22, 2026 at 12:19 AM Pu Lehui <pulehui@huaweicloud.com> wrote:
>>
>> From: Pu Lehui <pulehui@huawei.com>
>>
>> In bpf_netns_link_update_prog, the checks for old_prog and prog type
>> are currently performed locklessly before acquiring netns_bpf_mutex.
>> This creates a race condition that can lead to a UAF issue.
>>
>> If two threads concurrently execute BPF_LINK_UPDATE on the same netns
>> link, the following execution path can trigger a UAF:
>>
>> CPU0                                          CPU1
>> bpf_netns_link_update_prog
>>    if (old_prog && old_prog != link->prog)
>>      return -EPERM;
>>                                                bpf_netns_link_update_prog
>>                                                  if (old_prog && old_prog != link->prog)
>>                                                  ...
>>                                                  old_prog = xchg(&link->prog, new_prog);
>>                                                  bpf_prog_put(old_prog);
>>    if (new_prog->type != link->prog->type) <-- trigger UAF
>>
>> Fix this by moving the old_prog and prog->type checks inside the
>> netns_bpf_mutex critical section.
>>
>> Fixes: 7f045a49fee0 ("bpf: Add link-based BPF program attachment to network namespace")
>> Reported-by: Sashiko <sashiko-bot@kernel.org>
>> Reviewed-by: Amery Hung <ameryhung@gmail.com>
>> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
>> Signed-off-by: Pu Lehui <pulehui@huawei.com>
>> ---
>>   kernel/bpf/net_namespace.c | 14 +++++++++-----
>>   1 file changed, 9 insertions(+), 5 deletions(-)
>>
> 
> the change is good, all other link types do take lock first and then
> do all the checking, netns is the only oddball, but see implementation
> nit below
> 
>> diff --git a/kernel/bpf/net_namespace.c b/kernel/bpf/net_namespace.c
>> index 25f30f9edaef..9fc62db1441c 100644
>> --- a/kernel/bpf/net_namespace.c
>> +++ b/kernel/bpf/net_namespace.c
>> @@ -171,13 +171,17 @@ static int bpf_netns_link_update_prog(struct bpf_link *link,
>>          struct net *net;
>>          int idx, ret;
>>
>> -       if (old_prog && old_prog != link->prog)
>> -               return -EPERM;
>> -       if (new_prog->type != link->prog->type)
>> -               return -EINVAL;
>> -
>>          mutex_lock(&netns_bpf_mutex);
>>
>> +       if (old_prog && old_prog != link->prog) {
>> +               ret = -EPERM;
>> +               goto out_unlock;
>> +       }
>> +       if (new_prog->type != link->prog->type) {
>> +               ret = -EINVAL;
>> +               goto out_unlock;
> 
> can we use guard() and avoid all the goto jumping?

ok, will update next

> 
> pw-bot: cr
> 
> 
>> +       }
>> +
>>          net = net_link->net;
>>          if (!net || !check_net(net)) {
>>                  /* Link auto-detached or netns dying */
>> --
>> 2.34.1
>>