Re: [PATCH bpf v4 2/4] bpf: Fix UAF due to missing link type check in mprog

[Amery Hung]

On 7/20/26 6:45 AM, Pu Lehui wrote:
> From: Pu Lehui <pulehui@xxxxxxxxxx>
>
> In bpf_mprog_link, the code does not check the link->type first before
> dereferencing link->prog->type. This missing validation allows a user to
> pass an abnormal non-netkit or non-tcx link via relative_fd. If do
> BPF_LINK_UPDATE on the abnormal link, it can trigger a UAF issue.
>
> CPU0                                      CPU1
> netkit_link_prog_attach
> bpf_mprog_attach
> bpf_mprog_tuple_relative
> bpf_mprog_link
>    link = bpf_link_get_from_fd(id_or_fd);
>                                            BPF_LINK_UPDATE
>                                            ...
>                                            old_prog = xchg(&link->link.prog, new_prog);
>                                            bpf_prog_put(old_prog);
>    if (type && link->prog->type != type) <-- trigger UAF
>
> Fix this by strictly validate link->type in bpf_mprog_link against the
> expected link type. bpf_mprog_tuple_relative is also adjusted to accept
> and pass down the expected link type.
>
> Fixes: 053c8e1f235d ("bpf: Add generic attach/detach/query API for multi-progs")
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Signed-off-by: Pu Lehui <pulehui@xxxxxxxxxx>

Reviewed-by: Amery Hung <ameryhung@xxxxxxxxx>

The message can be improved. The reason for the UAF is that each 
subsystem provides its own protection for link->prog. Since there is no 
cross subsystem protection (if not considering the RCU of prog tear 
down), dereferencing the prog of an anchor link that does not belong to 
the current subsystem is not safe: it may have been freed. Therefore, we
need to validate link->type to reject foreign anchors.

There are also some grammar errors:
If do -> If doing
strictly validate -> strictly validating.

> ---
>   kernel/bpf/mprog.c | 15 ++++++++++-----
>   1 file changed, 10 insertions(+), 5 deletions(-)
>
> diff --git a/kernel/bpf/mprog.c b/kernel/bpf/mprog.c
> index 1394168062e8..367f8f10da0a 100644
> --- a/kernel/bpf/mprog.c
> +++ b/kernel/bpf/mprog.c
> @@ -6,7 +6,7 @@
>   
>   static int bpf_mprog_link(struct bpf_tuple *tuple,
>   			  u32 id_or_fd, u32 flags,
> -			  enum bpf_prog_type type)
> +			  enum bpf_link_type type)
>   {
>   	struct bpf_link *link = ERR_PTR(-EINVAL);
>   	bool id = flags & BPF_F_ID;
> @@ -17,7 +17,7 @@ static int bpf_mprog_link(struct bpf_tuple *tuple,
>   		link = bpf_link_get_from_fd(id_or_fd);
>   	if (IS_ERR(link))
>   		return PTR_ERR(link);
> -	if (type && link->prog->type != type) {
> +	if (type && link->type != type) {
>   		bpf_link_put(link);
>   		return -EINVAL;
>   	}
> @@ -52,21 +52,22 @@ static int bpf_mprog_prog(struct bpf_tuple *tuple,
>   
>   static int bpf_mprog_tuple_relative(struct bpf_tuple *tuple,
>   				    u32 id_or_fd, u32 flags,
> -				    enum bpf_prog_type type)
> +				    enum bpf_link_type ltype,
> +				    enum bpf_prog_type ptype)
>   {
>   	bool link = flags & BPF_F_LINK;
>   	bool id = flags & BPF_F_ID;
>   
>   	memset(tuple, 0, sizeof(*tuple));
>   	if (link)
> -		return bpf_mprog_link(tuple, id_or_fd, flags, type);
> +		return bpf_mprog_link(tuple, id_or_fd, flags, ltype);
>   	/* If no relevant flag is set and no id_or_fd was passed, then
>   	 * tuple link/prog is just NULLed. This is the case when before/
>   	 * after selects first/last position without passing fd.
>   	 */
>   	if (!id && !id_or_fd)
>   		return 0;
> -	return bpf_mprog_prog(tuple, id_or_fd, flags, type);
> +	return bpf_mprog_prog(tuple, id_or_fd, flags, ptype);
>   }
>   
>   static void bpf_mprog_tuple_put(struct bpf_tuple *tuple)
> @@ -243,6 +244,8 @@ int bpf_mprog_attach(struct bpf_mprog_entry *entry,
>   		return -EEXIST;
>   	ret = bpf_mprog_tuple_relative(&rtuple, id_or_fd,
>   				       flags & ~BPF_F_REPLACE,
> +				       link ? link->type :
> +				       BPF_LINK_TYPE_UNSPEC,

nit: keep it in a line. It is well under 100 cols.

>   				       prog_new->type);
>   	if (ret)
>   		return ret;
> @@ -343,6 +346,8 @@ int bpf_mprog_detach(struct bpf_mprog_entry *entry,
>   	if (!bpf_mprog_total(entry))
>   		return -ENOENT;
>   	ret = bpf_mprog_tuple_relative(&rtuple, id_or_fd, flags,
> +				       link ? link->type :
> +				       BPF_LINK_TYPE_UNSPEC,

Same here.

>   				       prog ? prog->type :
>   				       BPF_PROG_TYPE_UNSPEC);
>   	if (ret)