Re: [PATCH bpf-next v3] bpf: Fix stack out-of-bounds write in cgroup link update

[Leon Hwang]

On 2026/8/21 16:47, Sanghyun Park wrote:
[...]
>  
> @@ -5968,6 +5975,22 @@ static int link_update(union bpf_attr *attr)
>  		goto out_put_progs;
>  	}
>  
> +	if (link->type == BPF_LINK_TYPE_CGROUP) {

Furthermore, I think this link type check can be dropped. Then,
link_update() will keep the same bpf_prog_attach_check_attach_type()
with link_create().

WDYT?

Thanks,
Leon

> +		atype = link->attach_type;
> +		/*
> +		 * BPF_LSM_MAC and BPF_LSM_CGROUP share BPF_PROG_TYPE_LSM, so
> +		 * the helper's default prog-type check cannot distinguish them.
> +		 */
> +		if (new_prog->type == BPF_PROG_TYPE_LSM &&
> +		    new_prog->expected_attach_type != atype)
> +			ret = -EINVAL;
> +		else
> +			ret = bpf_prog_attach_check_attach_type(new_prog,
> +								atype);
> +		if (ret)
> +			goto out_put_progs;
> +	}
> +
>  	if (link->ops->update_prog)
>  		ret = link->ops->update_prog(link, new_prog, old_prog);
>  	else