linux-kernel - Re: [PATCH bpf] xsk: fix init race causing NPD/UAF in xsk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <495e261276ae70d5936875e2c5b1d1a03646a1589526ff83cd7b70b6baf1614b@mail.kernel.org>
Date: Thu,  8 Jan 2026 11:21:44 +0000 (UTC)
From: bot+bpf-ci@...nel.org
To: qikeyu2017@...il.com,bpf@...r.kernel.org
Cc: linux-kernel@...r.kernel.org,qikeyu2017@...il.com,ast@...nel.org,andrii@...nel.org,daniel@...earbox.net,martin.lau@...nel.org,eddyz87@...il.com,yonghong.song@...ux.dev,clm@...a.com,ihor.solodrai@...ux.dev
Subject: Re: [PATCH bpf] xsk: fix init race causing NPD/UAF in xsk_create()

> diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
> index f093c3453f64..63b48e4b8b65 100644
> --- a/net/xdp/xsk.c
> +++ b/net/xdp/xsk.c
> @@ -1922,10 +1922,6 @@ static int __init xsk_init(void)
>  	if (err)
>  		goto out;
>
> -	err = sock_register(&xsk_family_ops);
> -	if (err)
> -		goto out_proto;
> -
>  	err = register_pernet_subsys(&xsk_net_ops);
>  	if (err)
>  		goto out_sk;

[ ... ]

> @@ -1942,16 +1938,20 @@ static int __init xsk_init(void)
>  		goto out_unreg_notif;
>  	}
>
> +	err = sock_register(&xsk_family_ops);
> +	if (err)
> +		goto out_proto;
> +
>  	return 0;
>
>  out_unreg_notif:
>  	unregister_netdevice_notifier(&xsk_netdev_notifier);
>  out_pernet:
>  	unregister_pernet_subsys(&xsk_net_ops);
> -out_sk:
> -	sock_unregister(PF_XDP);
>  out_proto:
>  	proto_unregister(&xsk_proto);
> +out_sk:
> +	sock_unregister(PF_XDP);

The error unwind path looks incorrect. If register_pernet_subsys() fails,
the code jumps to out_sk which now calls sock_unregister(PF_XDP). However,
at that point sock_register() has not been called yet since it was moved
to after kmem_cache_create().

Looking at the execution path:

    proto_register() succeeds
    register_pernet_subsys() fails
    goto out_sk
    -> out_sk: sock_unregister(PF_XDP)  // sock_register() was never called

The same issue affects register_netdevice_notifier() and kmem_cache_create()
failures - they all eventually fall through to out_sk and call
sock_unregister() before sock_register() was ever called.

Should out_sk be placed before out_proto in the error unwind section, or
should the goto targets be updated? The original code had the error unwind
labels in the correct order relative to the registration sequence.

>  out:
>  	return err;
>  }


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/20814824025