Re: [PATCH bpf v6 2/4] bpf: Fix UAF due to missing link type check in mprog

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `rcu_read_lock()` in `bpf_link_show_fdinfo` and `bpf_link_get_info_by_fd` allows Use-After-Free of `link->prog`.
--

--- Patch [2]: [PATCH bpf v6 2/4] bpf: Fix UAF due to missing link type check in mprog ---
commit d6fd76d2df1307731a401336010d5bd9b2102da9
Author: Pu Lehui <pulehui@huawei.com>

bpf: Fix UAF due to missing link type check in mprog

This patch validates the link type in bpf_mprog_link before accessing
the underlying program type. This prevents a use-after-free when an
unsupported link is updated concurrently.

> diff --git a/kernel/bpf/mprog.c b/kernel/bpf/mprog.c
> index 1394168062e85..b4a1b35ff5693 100644
> --- a/kernel/bpf/mprog.c
> +++ b/kernel/bpf/mprog.c
> @@ -17,7 +17,7 @@ static int bpf_mprog_link(struct bpf_tuple *tuple,
>  		link = bpf_link_get_from_fd(id_or_fd);
>  	if (IS_ERR(link))
>  		return PTR_ERR(link);
> -	if (type && link->prog->type != type) {
> +	if (type && link->type != type) {

[Severity: High]
This is a pre-existing issue, but I noticed another potential UAF involving
link->prog being accessed without RCU protection.

When a BPF link is updated, link->prog is swapped and the old program is freed
after an RCU grace period. If a thread invokes sys_bpf with
BPF_OBJ_GET_INFO_BY_FD or reads fdinfo for a BPF link, it accesses link->prog.

In kernel/bpf/syscall.c:bpf_link_show_fdinfo():

	const struct bpf_prog *prog = link->prog;
...
	if (prog) {
		bin2hex(prog_tag, prog->tag, sizeof(prog->tag));
		seq_printf(m,
			   "prog_tag:\t%s\n"
			   "prog_id:\t%u\n",
			   prog_tag,
			   prog->aux->id);

Can this dereference a freed prog pointer if a concurrent BPF_LINK_UPDATE
swaps and frees the program before the grace period expires, since
rcu_read_lock() is not held?

A similar pattern appears in kernel/bpf/syscall.c:bpf_link_get_info_by_fd():

	if (link->prog)
		info.prog_id = link->prog->aux->id;

Does this code also need RCU protection against concurrent updates?

>  		bpf_link_put(link);
>  		return -EINVAL;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722072326.1545677-1-pulehui@huaweicloud.com?part=2