linux-kernel - Re: [PATCH bpf] xsk: fix init race causing NPD/UAF in xsk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aWQG9Xujon2RWeci@mini-arch>
Date: Sun, 11 Jan 2026 12:24:21 -0800
From: Stanislav Fomichev <stfomichev@...il.com>
To: Kery Qi <qikeyu2017@...il.com>
Cc: bpf@...r.kernel.org, linux-kernel@...r.kernel.org, bjorn@...nel.org,
	hawk@...nel.org, pabeni@...hat.com, magnus.karlsson@...el.com,
	daniel@...earbox.net, maciej.fijalkowski@...el.com, kuba@...nel.org,
	edumazet@...gle.com, horms@...nel.org, ast@...nel.org,
	sdf@...ichev.me, john.fastabend@...il.com
Subject: Re: [PATCH bpf] xsk: fix init race causing NPD/UAF in xsk_create()

On 01/09, Kery Qi wrote:
> xsk_init() previously registered the PF_XDP socket family before the
> per-net subsystem and other prerequisites (netdevice notifier, caches)
> were fully initialized.
> 
> This exposed .create = xsk_create() to user space while per-netns
> state (net->xdp.lock/list) was still uninitialized. A task with
> CAP_NET_RAW could trigger this during boot/module load by calling
> socket(PF_XDP, SOCK_RAW, 0) concurrently with xsk_init(), leading
> to a NULL pointer dereference or use-after-free in the list manipulation.
> 
> To fix this, move sock_register() to the end of the initialization
> sequence, ensuring that all required kernel structures are ready before
> exposing the AF_XDP interface to userspace.
> 
> Accordingly, reorder the error unwind path to ensure proper cleanup
> in reverse order of initialization. Also, explicitly add
> kmem_cache_destroy() in the error path to prevent leaking
> xsk_tx_generic_cache if the registration fails.

Is it something that you've hit in real life? xsk_init happens
so early during the init process (fs_init) that I don't understand
why the oder would matter.