Re: [PATCH bpf-next v3 3/7] exec: Clear bprm->mm before dropping its reference

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free of `bprm->file` via eBPF kfuncs due to dangling trusted pointer.
--

commit ac94f9ff4f270354d3714d4162d6adfa946a8fdf
Author: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>

exec: Clear bprm->mm before dropping its reference

This commit clears bprm->mm before calling mmput() in free_bprm().
This ensures that eBPF programs cannot access a dangling mm_struct
pointer when hooking into execution paths.

> diff --git a/fs/exec.c b/fs/exec.c
> index a14f28b15607a..4b4d8f0627a7c 100644
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -1453,9 +1453,12 @@ void bprm_drop_loader(struct linux_binprm *bprm)
>  
>  static void free_bprm(struct linux_binprm *bprm)
>  {
> -	if (bprm->mm) {
> +	struct mm_struct *mm = bprm->mm;
> +
> +	if (mm) {
>  		acct_arg_size(bprm, 0);
> -		mmput(bprm->mm);
> +		bprm->mm = NULL;
> +		mmput(mm);
>  	}
>  	if (bprm->user_ns)
>  		put_user_ns(bprm->user_ns);

[Severity: High]
This is a pre-existing issue, but since this patch addresses dangling
pointers in free_bprm() for eBPF, does bprm->file need similar handling?

Further down in free_bprm(), the code drops the file reference and then
calls a hookable function:

	do_close_execat(bprm->file);
	/* An unconsumed PT_INTERP substitute from a binfmt_misc loader entry. */
	bprm_drop_loader(bprm);

When kernel_execve() fails in a kernel thread, free_bprm() is called.
The do_close_execat() call drops the final reference to the file.
Because this executes in a kernel thread (PF_KTHREAD), fput() queues
the file for asynchronous freeing via delayed_fput_work.

Right after this, bprm_drop_loader() is called. If an eBPF fentry program
is attached to bprm_drop_loader, it receives the bprm argument.

Because the BPF verifier defines the file pointer within linux_binprm as
BTF_TYPE_SAFE_TRUSTED, the verifier trusts the pointer. The eBPF program
can read bprm->file and pass it to a kfunc like bpf_get_file_xattr().

Could this result in a use-after-free if the kfunc dereferences the file
pointer concurrently while the workqueue frees it?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831092305.42062-1-tasos.papagiannnis@gmail.com?part=3