[PATCH bpf-next] bpf: Fix stack out-of-bounds write in cgroup link update

[PATCH bpf-next] bpf: Fix stack out-of-bounds write in cgroup link update

[Sanghyun Park]

The cgroup link update path checks only the program type, allowing a UDP6
sock_addr program to replace the program on a UDP4 link. Running the
replacement writes past the smaller IPv4 context into ipcm_cookie::opt on the
stack.

Require a replacement sock_addr program to have the same expected attach type
as the link before changing link state. Limit the check to sock_addr programs
so update policy for other cgroup program types remains unchanged.

Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link")
Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
---
 kernel/bpf/cgroup.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index d2da5063d8f8..65bf25deac4f 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -1055,6 +1055,10 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp,
 	if (link->link.prog->type != new_prog->type)
 		return -EINVAL;
 
+	if (new_prog->type == BPF_PROG_TYPE_CGROUP_SOCK_ADDR &&
+	    link->link.attach_type != new_prog->expected_attach_type)
+		return -EINVAL;
+
 	hlist_for_each_entry(pl, progs, node) {
 		if (pl->link == link) {
 			found = true;
-- 
2.48.1

Re: [PATCH bpf-next] bpf: Fix stack out-of-bounds write in cgroup link update

[Pu Lehui]

On 2026/8/5 13:28, Sanghyun Park wrote:
> The cgroup link update path checks only the program type, allowing a UDP6
> sock_addr program to replace the program on a UDP4 link. Running the
> replacement writes past the smaller IPv4 context into ipcm_cookie::opt on the
> stack.
> 
> Require a replacement sock_addr program to have the same expected attach type
> as the link before changing link state. Limit the check to sock_addr programs
> so update policy for other cgroup program types remains unchanged.
> 
> Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link")
> Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
> ---
>   kernel/bpf/cgroup.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
> index d2da5063d8f8..65bf25deac4f 100644
> --- a/kernel/bpf/cgroup.c
> +++ b/kernel/bpf/cgroup.c
> @@ -1055,6 +1055,10 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp,
>   	if (link->link.prog->type != new_prog->type)
>   		return -EINVAL;
>   
> +	if (new_prog->type == BPF_PROG_TYPE_CGROUP_SOCK_ADDR &&

not only BPF_PROG_TYPE_CGROUP_SOCK_ADDR, but also 
BPF_PROG_TYPE_CGROUP_SKB, BPF_PROG_TYPE_CGROUP_SOCK, etc. I think we can 
make it general.

> +	    link->link.attach_type != new_prog->expected_attach_type)

use link->link.prog->expected_attach_type

> +		return -EINVAL;
> +
>   	hlist_for_each_entry(pl, progs, node) {
>   		if (pl->link == link) {
>   			found = true;

Re: [PATCH bpf-next] bpf: Fix stack out-of-bounds write in cgroup link update

[Sanghyun Park]

Hello Lehui,

Thank you for the review.

> not only BPF_PROG_TYPE_CGROUP_SOCK_ADDR, but also
> BPF_PROG_TYPE_CGROUP_SKB, BPF_PROG_TYPE_CGROUP_SOCK, etc. I think we can
> make it general.

Yes, it seems we should cover the other cgroup programs too.

> use link->link.prog->expected_attach_type

AFAIK, for CGROUP_SKB, the current program's expected_attach_type is not always
the link's actual attach type. Non-enforcing ingress and egress programs are
intentionally interchangeable for backward compatibility (ref: commit
5cf1e9145630).

I think we should validate the new program against link->attach_type while
preserving the existing compatibility rules. Let me send a v2 with a new
approach.