Re: [PATCH bpf] xsk: fix init race causing NPD/UAF in xsk_create()

[Stanislav Fomichev <stfomichev@gmail.com>]

On 01/09, Kery Qi wrote:
> xsk_init() previously registered the PF_XDP socket family before the
> per-net subsystem and other prerequisites (netdevice notifier, caches)
> were fully initialized.
> 
> This exposed .create = xsk_create() to user space while per-netns
> state (net->xdp.lock/list) was still uninitialized. A task with
> CAP_NET_RAW could trigger this during boot/module load by calling
> socket(PF_XDP, SOCK_RAW, 0) concurrently with xsk_init(), leading
> to a NULL pointer dereference or use-after-free in the list manipulation.
> 
> To fix this, move sock_register() to the end of the initialization
> sequence, ensuring that all required kernel structures are ready before
> exposing the AF_XDP interface to userspace.
> 
> Accordingly, reorder the error unwind path to ensure proper cleanup
> in reverse order of initialization. Also, explicitly add
> kmem_cache_destroy() in the error path to prevent leaking
> xsk_tx_generic_cache if the registration fails.

Is it something that you've hit in real life? xsk_init happens
so early during the init process (fs_init) that I don't understand
why the oder would matter.