Re: [PATCH bpf] xsk: fix init race causing NPD/UAF in xsk_create()

[bot+bpf-ci]

> diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
> index f093c3453f64..63b48e4b8b65 100644
> --- a/net/xdp/xsk.c
> +++ b/net/xdp/xsk.c
> @@ -1922,10 +1922,6 @@ static int __init xsk_init(void)
>  	if (err)
>  		goto out;
>
> -	err = sock_register(&xsk_family_ops);
> -	if (err)
> -		goto out_proto;
> -
>  	err = register_pernet_subsys(&xsk_net_ops);
>  	if (err)
>  		goto out_sk;

[ ... ]

> @@ -1942,16 +1938,20 @@ static int __init xsk_init(void)
>  		goto out_unreg_notif;
>  	}
>
> +	err = sock_register(&xsk_family_ops);
> +	if (err)
> +		goto out_proto;
> +
>  	return 0;
>
>  out_unreg_notif:
>  	unregister_netdevice_notifier(&xsk_netdev_notifier);
>  out_pernet:
>  	unregister_pernet_subsys(&xsk_net_ops);
> -out_sk:
> -	sock_unregister(PF_XDP);
>  out_proto:
>  	proto_unregister(&xsk_proto);
> +out_sk:
> +	sock_unregister(PF_XDP);

The error unwind path looks incorrect. If register_pernet_subsys() fails,
the code jumps to out_sk which now calls sock_unregister(PF_XDP). However,
at that point sock_register() has not been called yet since it was moved
to after kmem_cache_create().

Looking at the execution path:

    proto_register() succeeds
    register_pernet_subsys() fails
    goto out_sk
    -> out_sk: sock_unregister(PF_XDP)  // sock_register() was never called

The same issue affects register_netdevice_notifier() and kmem_cache_create()
failures - they all eventually fall through to out_sk and call
sock_unregister() before sock_register() was ever called.

Should out_sk be placed before out_proto in the error unwind section, or
should the goto targets be updated? The original code had the error unwind
labels in the correct order relative to the registration sequence.

>  out:
>  	return err;
>  }


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/20814824025