Re: [PATCH bpf-next] bpf: Fix stack out-of-bounds write in cgroup link update

On 2026/8/5 13:28, Sanghyun Park wrote:
> The cgroup link update path checks only the program type, allowing a UDP6
> sock_addr program to replace the program on a UDP4 link. Running the
> replacement writes past the smaller IPv4 context into ipcm_cookie::opt on the
> stack.
> 
> Require a replacement sock_addr program to have the same expected attach type
> as the link before changing link state. Limit the check to sock_addr programs
> so update policy for other cgroup program types remains unchanged.
> 
> Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link")
> Signed-off-by: Sanghyun Park <[email protected]>
> ---
>   kernel/bpf/cgroup.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
> index d2da5063d8f8..65bf25deac4f 100644
> --- a/kernel/bpf/cgroup.c
> +++ b/kernel/bpf/cgroup.c
> @@ -1055,6 +1055,10 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp,
>   	if (link->link.prog->type != new_prog->type)
>   		return -EINVAL;
>   
> +	if (new_prog->type == BPF_PROG_TYPE_CGROUP_SOCK_ADDR &&

not only BPF_PROG_TYPE_CGROUP_SOCK_ADDR, but also 
BPF_PROG_TYPE_CGROUP_SKB, BPF_PROG_TYPE_CGROUP_SOCK, etc. I think we can 
make it general.

> +	    link->link.attach_type != new_prog->expected_attach_type)

use link->link.prog->expected_attach_type

> +		return -EINVAL;
> +
>   	hlist_for_each_entry(pl, progs, node) {
>   		if (pl->link == link) {
>   			found = true;