[PATCH bpf] bpf: reject dev-bound programs on unregistering devices

[PATCH bpf] bpf: reject dev-bound programs on unregistering devices

[Weiming Shi]

bpf_prog_dev_bound_init() takes a reference to the target netdev with
dev_get_by_index(), then initializes the BPF offload state later under
bpf_devs_lock. If unregister_netdevice_many_notify() runs in between,
bpf_dev_bound_netdev_unregister() can observe that no bound-only ondev
exists yet and return. The loader can then create a new bound-only ondev
for a device whose unregister path has already passed the BPF cleanup
point, leaving prog->aux->offload->netdev dangling after dev_put().

Reject new dev-bound state once the device has left NETREG_REGISTERED.
The unregister path sets NETREG_UNREGISTERING before BPF cleanup, and
both initialization and cleanup hold bpf_devs_lock, so no ondev can be
created after cleanup has passed.

The race was reproduced without kernel source instrumentation by using a
tracing BPF fexit program to signal and widen the interval immediately
after dev_get_by_index() returns. KASAN reported:

  BUG: KASAN: slab-use-after-free in bpf_dev_bound_resolve_kfunc (kernel/bpf/offload.c:846)
  Read of size 8
  bpf_dev_bound_resolve_kfunc (kernel/bpf/offload.c:846)
  bpf_fixup_kfunc_call (kernel/bpf/verifier.c:20595)
  bpf_do_misc_fixups (kernel/bpf/fixups.c:1888)
  bpf_check (kernel/bpf/verifier.c:21201)
  bpf_prog_load (kernel/bpf/syscall.c:3133)
  __sys_bpf (kernel/bpf/syscall.c:6367)

The object was freed concurrently through:

  netdev_run_todo (net/core/dev.c:11818)
  rtnl_dellink (net/core/rtnetlink.c:3702)

Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs")
Reported-by: <co+e4b67bb653c9bb8b@bugs.sh>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
Please queue this fix for stable kernels.

 kernel/bpf/offload.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
index 0d6f5569588c3..5e05517d06c7c 100644
--- a/kernel/bpf/offload.c
+++ b/kernel/bpf/offload.c
@@ -182,6 +182,9 @@ static int __bpf_prog_dev_bound_init(struct bpf_prog *prog, struct net_device *n
 	struct bpf_prog_offload *offload;
 	int err;
 
+	if (READ_ONCE(netdev->reg_state) != NETREG_REGISTERED)
+		return -ENODEV;
+
 	offload = kzalloc_obj(*offload, GFP_USER);
 	if (!offload)
 		return -ENOMEM;
-- 
2.55.0