Skip to contentSkip to conversation

bpf: Fix use-after-free in offloaded map/prog info fill

PATCH Applied Jiayuan Chen 3 participants 3 messages Apr 9 BPF

lore
Share & tools
lore

Jiayuan Chen

author
#0 lore raw

PATCH v2 1/1 bpf: Fix use-after-free in offloaded map/prog info fill

When querying info for an offloaded BPF map or program, bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() obtain the network namespace with get_net(dev_net(offmap->netdev)). However, the associated netdev's netns may be racing with teardown during netns destruction. If the netns refcount has already reached 0, get_net() performs a refcount_t increment on 0, triggering:

refcount_t: addition on 0; use-after-free.

Although rtnl_lock and bpf_devs_lock ensure the netdev pointer remains valid, they cannot prevent the netns refcount from reaching zero.

Fix this by using maybe_get_net() instead of get_net(). maybe_get_net() uses refcount_inc_not_zero() and returns NULL if the refcount is already zero, which causes ns_get_path_cb() to fail and the caller to return -ENOENT -- the correct behavior when the netns is being destroyed.

Fixes 675fc275a3a2d ("bpf: offload: report device information for offloaded programs")
Fixes 52775b33bb507 ("bpf: offload: report device information about offloaded maps")
Reported-by Yinhao Hu <[email protected]>
Reported-by Kaiyan Mei <[email protected]>
Reviewed-by Dongliang Mu <[email protected]>
Closes https://lore.kernel.org/bpf/[email protected]/ open here
Signed-off-by Jiayuan Chen <[email protected]>

---
v1 -> v2: fix the commit message and simplify to ternary.
v1: https://lore.kernel.org/bpf/[email protected]/

---
 kernel/bpf/offload.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)
kernel/bpf/offload.c +4 -6
index 0ad97d643bf49..0d6f5569588c3 100644
@@ -435,9 +435,8 @@ static struct ns_common *bpf_prog_offload_info_fill_ns(void *private_data)
 
 	if (aux->offload) {
 		args->info->ifindex = aux->offload->netdev->ifindex;
-		net = dev_net(aux->offload->netdev);
-		get_net(net);
-		ns = &net->ns;
+		net = maybe_get_net(dev_net(aux->offload->netdev));
+		ns = net ? &net->ns : NULL;
 	} else {
 		args->info->ifindex = 0;
 		ns = NULL;

@@ -647,9 +646,8 @@ static struct ns_common *bpf_map_offload_info_fill_ns(void *private_data)
 
 	if (args->offmap->netdev) {
 		args->info->ifindex = args->offmap->netdev->ifindex;
-		net = dev_net(args->offmap->netdev);
-		get_net(net);
-		ns = &net->ns;
+		net = maybe_get_net(dev_net(args->offmap->netdev));
+		ns = net ? &net->ns : NULL;
 	} else {
 		args->info->ifindex = 0;
 		ns = NULL;
Signature · 1 line
2.43.0
maintainer Acked-by on v2 1/1
#1 lore raw
Quoted 24 lines · Jiayuan Chen

When querying info for an offloaded BPF map or program, bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() obtain the network namespace with get_net(dev_net(offmap->netdev)). However, the associated netdev's netns may be racing with teardown during netns destruction. If the netns refcount has already reached 0, get_net() performs a refcount_t increment on 0, triggering:

refcount_t: addition on 0; use-after-free.

Although rtnl_lock and bpf_devs_lock ensure the netdev pointer remains valid, they cannot prevent the netns refcount from reaching zero.

Fix this by using maybe_get_net() instead of get_net(). maybe_get_net() uses refcount_inc_not_zero() and returns NULL if the refcount is already zero, which causes ns_get_path_cb() to fail and the caller to return -ENOENT -- the correct behavior when the netns is being destroyed.

Fixes 675fc275a3a2d ("bpf: offload: report device information for offloaded programs")
Fixes 52775b33bb507 ("bpf: offload: report device information about offloaded maps")
Reported-by Yinhao Hu <[email protected]>
Reported-by Kaiyan Mei <[email protected]>
Reviewed-by Dongliang Mu <[email protected]>
Closes https://lore.kernel.org/bpf/[email protected]/ open here
Signed-off-by Jiayuan Chen <[email protected]>
Quoted 3 lines

---
v1 -> v2: fix the commit message and simplify to ternary.
v1: https://lore.kernel.org/bpf/[email protected]/

Acked-by Daniel Borkmann <[email protected]>

(should go into bpf-next)

CI Applied
#2 lore raw
In reply to Jiayuan Chen
This patch was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <[email protected]>:

Hello:

This patch was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <[email protected]>:

Quoted 8 lines · On Thu, 9 Apr 2026 10:37:32 +0800 you wrote:

When querying info for an offloaded BPF map or program, bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() obtain the network namespace with get_net(dev_net(offmap->netdev)). However, the associated netdev's netns may be racing with teardown during netns destruction. If the netns refcount has already reached 0, get_net() performs a refcount_t increment on 0, triggering:

[...]

Here is the summary with links:
- [bpf,v2] bpf: Fix use-after-free in offloaded map/prog info fill

    https://git.kernel.org/bpf/bpf-next/c/a0c584fc1805

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html