linux-kernel - RE: [PATCH] xsk: fix init race causing NPD/UAF in xsk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <DS7PR11MB76910BB046DB867928CA8D18F785A@DS7PR11MB7691.namprd11.prod.outlook.com>
Date: Thu, 8 Jan 2026 10:25:30 +0000
From: "Karlsson, Magnus" <magnus.karlsson@...el.com>
To: Kery Qi <qikeyu2017@...il.com>
CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"Fijalkowski, Maciej" <maciej.fijalkowski@...el.com>
Subject: RE: [PATCH] xsk: fix init race causing NPD/UAF in xsk_create()


> 
> xsk_init() registers the PF_XDP socket family before xsk_net_ops.
> This exposes .create = xsk_create() to user space while per-netns
> state (net->xdp.lock/list) is still uninitialized.
> 
> A task with CAP_NET_RAW can trigger this during boot/module load by
> calling socket(PF_XDP/AF_XDP, SOCK_RAW, 0) concurrently with xsk_init(),
> leading to NULL deref, list/lock corruption or use-after-free.
> 
> Register the pernet subsystem (and prerequisites) first and only then
> sock_register() PF_XDP. Update the error unwind to match the new order.
> 
> Similar to CVE-2024-26793 (GTP init ordering bug).

Thanks for spotting and fixing this. Some things to fix though:

* Add a Fixes tag
* [PATCH] -> [PATCH bpf]
* Resubmit this to the bpf mailing list. You can keep the linux-kernel mailing list if you want of course.
 
> Signed-off-by: Kery Qi <qikeyu2017@...il.com>
> ---
>  net/xdp/xsk.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
> index f093c3453f64..63b48e4b8b65 100644
> --- a/net/xdp/xsk.c
> +++ b/net/xdp/xsk.c
> @@ -1922,10 +1922,6 @@ static int __init xsk_init(void)
>  	if (err)
>  		goto out;
> 
> -	err = sock_register(&xsk_family_ops);
> -	if (err)
> -		goto out_proto;
> -
>  	err = register_pernet_subsys(&xsk_net_ops);
>  	if (err)
>  		goto out_sk;
> @@ -1942,16 +1938,20 @@ static int __init xsk_init(void)
>  		goto out_unreg_notif;
>  	}
> 
> +	err = sock_register(&xsk_family_ops);
> +	if (err)
> +		goto out_proto;
> +
>  	return 0;
> 
>  out_unreg_notif:
>  	unregister_netdevice_notifier(&xsk_netdev_notifier);
>  out_pernet:
>  	unregister_pernet_subsys(&xsk_net_ops);
> -out_sk:
> -	sock_unregister(PF_XDP);
>  out_proto:
>  	proto_unregister(&xsk_proto);
> +out_sk:
> +	sock_unregister(PF_XDP);
>  out:
>  	return err;
>  }
> --
> 2.34.1