Re: [PATCH bpf v6 0/4] Fixes for bpf link update

[Pu Lehui]

On 2026/7/28 7:17, Andrii Nakryiko wrote:
> On Wed, Jul 22, 2026 at 12:19 AM Pu Lehui <pulehui@xxxxxxxxxxxxxxx> wrote:
> > From: Pu Lehui <pulehui@xxxxxxxxxx>
> >
> > This patch series addresses a few concurrency UAF issues within bpf link update.
>
> each fix is independent from each other, can you please split patch
> set into individual patches, please? some of them are straightforward

Makes total sense, I'll do this.

> and can be applied soon, while others might require a bit more
> thorough review and some more iteration, so best to split and apply
> individually, IMO

Next time I hit unrelated sashiko issues, I’ll just send them separately 
from the start.

> > v6:
> > - BPF_F_LINK flag set means the relative id_or_fd is a link, not the object being
> >    attached. We can not get the link while attach a bare prog with relative link.
> >    So passing expected link type from callers of bpf_mprog_attach/detach. (Sashiko)
> > - Add comment to explain that why ptype == UNSPEC in bpf_mprog_detach. (Emil)
> >
> > v5: https://lore.kernel.org/bpf/20260721041048.1394085-1-pulehui@xxxxxxxxxxxxxxx
> > - Remove rcu_read_lock_trace as rcu_read_unlock is sufficient. (Mykyta)
> > - Improve commit msg for patch 2. (Amery)
> > - Add Reviewed-by tag by Amery.
> >
> > v4: https://lore.kernel.org/bpf/20260720134547.1289964-1-pulehui@xxxxxxxxxxxxxxx
> > - Add new fix for UAF due to missing link type check in mprog. (Sashiko)
> > - Add new fix for UAF in bpf_netns_link_update_prog. (Sashiko)
> > - Include the storage and flags rollbacks to patch4 for sake of code rigor,
> >    as it's hard to make update_effective_progs fail in __cgroup_bpf_attach.
> >
> > v3: https://lore.kernel.org/bpf/20260720033055.1215477-1-pulehui@xxxxxxxxxxxxxxx
> > - Add new fix for UAF issue when reading bpf link info. (Sashiko)
> > - Add new fix for storage not restored when update_effective_progs
> >    failed. (Sashiko)
> >
> > v2: https://lore.kernel.org/bpf/20260717073343.958862-1-pulehui@xxxxxxxxxxxxxxx
> > - Fix invalid access for in-place update when storage changed. (Sashiko)
> >
> > v1: https://lore.kernel.org/bpf/20260714014659.401063-1-pulehui@xxxxxxxxxxxxxxx
> >
> > Pu Lehui (4):
> >    bpf: Fix potential UAF in bpf_netns_link_update_prog
> >    bpf: Fix UAF due to missing link type check in mprog
> >    bpf: Fix potential UAF when reading bpf link info
> >    bpf, cgroup: Fix storage null-ptr-deref after replacing prog
> >
> >   drivers/net/netkit.c       | 13 ++++++-----
> >   include/linux/bpf_mprog.h  |  6 ++++--
> >   kernel/bpf/cgroup.c        | 44 +++++++++++++++++++++++++++++++++++++-
> >   kernel/bpf/mprog.c         | 23 ++++++++++++--------
> >   kernel/bpf/net_namespace.c | 14 +++++++-----
> >   kernel/bpf/syscall.c       | 21 ++++++++++++++----
> >   kernel/bpf/tcx.c           | 13 ++++++-----
> >   7 files changed, 99 insertions(+), 35 deletions(-)
> >
> > --
> > 2.34.1