From a86148f89f96bc7aa8d758163bd9191bc10da6f9 Mon Sep 17 00:00:00 2001 From: zhaoyuenan Date: Sat, 13 Dec 2025 14:50:27 +0800 Subject: [PATCH] fixup! bpf: decouple the lifetime of cgroup_bpf from cgroup itself We encountered UAF issue with bpf cgroup, which was caused by this patch. 8cd90e5df ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself") By comparing this patch in the upstream torvalds/Linux kernel tree[1], we found that we missed a line of changes in the qcom_sm8250 kernel tree. This can lead to a reference counting lifetime inconsistency, causing a UAF issue in the function "__cgroup_bpf_run_filter_skb", which can lead to kernel panics and random reboot issuse. The changes in our kernel tree [2] separated a portion of the code in the cgroup_sk_alloc function into the cgroup_sk_clone function. Therefore, the changes omission in 8cd90e5df need to be added to cgroup_sk_clone to fix the inconsistency in reference counting. Consistent with cgroup_sk_clone in GKI android13-5.10 [3] [1]: https://github.com/torvalds/linux/commit/4bfc0bb2c [2]: https://github.com/LineageOS/android_kernel_qcom_sm8250/commit/0505cc4c9 [3]: https://github.com/aosp-mirror/kernel_common/blob/android13-5.10/kernel/cgroup/cgroup.c#L6731 Fixes: https://gitlab.com/LineageOS/issues/android/-/issues/9458 The co-authors have reported stable operation on their devices for 7 days without any further restart issues caused by __cgroup_bpf_run_filter_skb. Co-authored-by: TwinbornPlate75 <3342733415@qq.com> Co-authored-by: zhaoyuenan Co-authored-by: Helium-Studio Co-authored-by: Hxsyzl Co-authored-by: crrashh1542 <1542@crrashh.com> Change-Id: Iba7ad237a53fec10bc89c7e8c716e899158dfad2 --- kernel/cgroup/cgroup.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 444cccb8fcd3..6719a1bb0028 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -6482,6 +6482,7 @@ void cgroup_sk_clone(struct sock_cgroup_data *skcd) * Don't use cgroup_get_live(). */ cgroup_get(sock_cgroup_ptr(skcd)); + cgroup_bpf_get(sock_cgroup_ptr(skcd)); } }