Re: [PATCH bpf v3] bpf: Fix potential UAF when reading bpf link info

[Leon Hwang]

On Tue, 28 Jul 2026 02:54:57 +0000, Pu Lehui <pulehui@xxxxxxxxxxxxxxx> wrote:
> From: Pu Lehui <pulehui@xxxxxxxxxx>
>
> In bpf_link_show_fdinfo and bpf_link_get_info_by_fd, link->prog is
> accessed without holding any locks. If the prog is concurrently replaced
> via bpf_link_update, the old prog can be freed, leading to a potential
> UAF issue.
>
> Fix this by accessing link->prog under RCU protection to safely fetch
> the pointer and guarantee its lifetime while reading its fields.
>
> Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link")
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Reviewed-by: Emil Tsalapatis <emil@xxxxxxxxxxxxxxx>
> Reviewed-by: Amery Hung <ameryhung@xxxxxxxxx>
> Signed-off-by: Pu Lehui <pulehui@xxxxxxxxxx>

Acked-by: Leon Hwang <leon.hwang@xxxxxxxxx>

> [...]