Re: bpf: Race condition in bpf_trampoline_unlink_cgroup_shim during concurrent cgroup LSM link release

[Martin KaFai Lau <martin.lau@linux.dev>]

On 11/25/25 3:14 AM, 梅开彦 wrote:
> Our fuzzer discovered a race condition vulnerability in the BPF subsystem, specifically in the release path for cgroup-attached LSM programs. When multiple BPF cgroup links attached to the same LSM hook are released concurrently, a race condition in `bpf_trampoline_unlink_cgroup_shim` can lead to state corruption, triggering a kernel warning (`ODEBUG bug in __init_work`) and a subsequent kernel panic.
> 
> Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
> Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
> Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
> 
> ## Vulnerability Description
> 
> The vulnerability is triggered when multiple threads concurrently close file descriptors corresponding to `bpf_cgroup_link`s that share a common underlying `bpf_shim_tramp_link`. The `bpf_link_put` function, which is called during the release path, is not designed to handle concurrent calls on the same link instance when its reference count is low. This race leads to the re-initialization of an already-active `work_struct`, a memory state corruption that is detected by the kernel's debug objects feature.

I don't think concurrent bpf_link_put(same_link) is the issue. 
bpf_link_put uses an atomic link->refcnt to handle this situation.

The race should be between the bpf_link_put() in 
bpf_trampoline_unlink_cgroup_shim() and the cgroup_shim_find() in 
bpf_trampoline_link_cgroup_shim(). The cgroup_shim_find() in 
bpf_trampoline_link_cgroup_shim() gets a shim_link with a refcnt 0, then 
a UAF.

The changes in commit ab5d47bd41b1 ("bpf: Remove in_atomic() from 
bpf_link_put().") made this bug easier to manifest as in the reproducer 
because the bpf_trampoline_unlink_prog() is always delayed.

A potential fix is to check the link->refcnt in 
bpf_trampoline_unlink_cgroup_shim() and call 
bpf_trampoline_unlink_prog() when needed inside the 
mutex_lock(&tr->mutex). Cc: Stanislav