bpf_prog_dev_bound_init() takes a reference to the target netdev with dev_get_by_index(), then initializes the BPF offload state later under bpf_devs_lock. If unregister_netdevice_many_notify() runs in between, bpf_dev_bound_netdev_unregister() can observe that no bound-only ondev exists yet and return. The loader can then create a new bound-only ondev for a device whose unregister path has already passed the BPF cleanup point, leaving prog->aux->offload->netdev dangling after dev_put(). Reject new dev-bound state once the device has left NETREG_REGISTERED. The unregister path sets NETREG_UNREGISTERING before BPF cleanup, and both initialization and cleanup hold bpf_devs_lock, so no ondev can be created after cleanup has passed. The race was reproduced without kernel source instrumentation by using a tracing BPF fexit program to signal and widen the interval immediately after dev_get_by_index() returns. KASAN reported: BUG: KASAN: slab-use-after-free in bpf_dev_bound_resolve_kfunc (kernel/bpf/offload.c:846) Read of size 8 bpf_dev_bound_resolve_kfunc (kernel/bpf/offload.c:846) bpf_fixup_kfunc_call (kernel/bpf/verifier.c:20595) bpf_do_misc_fixups (kernel/bpf/fixups.c:1888) bpf_check (kernel/bpf/verifier.c:21201) bpf_prog_load (kernel/bpf/syscall.c:3133) __sys_bpf (kernel/bpf/syscall.c:6367) The object was freed concurrently through: netdev_run_todo (net/core/dev.c:11818) rtnl_dellink (net/core/rtnetlink.c:3702) Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs") Reported-by: Assisted-by: LLM Signed-off-by: Weiming Shi --- Please queue this fix for stable kernels. kernel/bpf/offload.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c index 0d6f5569588c3..5e05517d06c7c 100644 --- a/kernel/bpf/offload.c +++ b/kernel/bpf/offload.c @@ -182,6 +182,9 @@ static int __bpf_prog_dev_bound_init(struct bpf_prog *prog, struct net_device *n struct bpf_prog_offload *offload; int err; + if (READ_ONCE(netdev->reg_state) != NETREG_REGISTERED) + return -ENODEV; + offload = kzalloc_obj(*offload, GFP_USER); if (!offload) return -ENOMEM; -- 2.55.0