Re: [PATCH] bpf: cgroup: fix null-ptr-deref in __cgroup_bpf_attach

[Jiayuan Chen <jiayuan.chen@linux.dev>]

on 9/2/26 5:02 PM, Liu Jing wrote:
> In __cgroup_bpf_attach(), the expression "prog ? : link->link.prog"
> dereferences link before validating that link is non-NULL. If both
> prog and link are NULL (a contract violation by the caller), this
> causes a null pointer dereference.


Both being NULL is unreachable, so the new check is dead code.

It's meaningless.


>
> Add a safe ternary fallback and a NULL check for new_prog before
> it is used further.
>
> Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
> ---
>   kernel/bpf/cgroup.c | 4 +++-
>   1 file changed, 3 insertion(+), 1 deletion(-)
>
> --- a/kernel/bpf/cgroup.c
> +++ b/kernel/bpf/cgroup.c
> @@ -814,7 +814,7 @@
>   	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
>   	struct bpf_cgroup_storage *new_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
>   	struct bpf_cgroup_storage *old_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
> -	struct bpf_prog *new_prog = prog ? : link->link.prog;
> +	struct bpf_prog *new_prog = prog ? : (link ? link->link.prog : NULL);
>   	enum cgroup_bpf_attach_type atype;
>   	u32 old_flags, old_pl_flags;
>   	struct bpf_prog_list *pl;
> @@ -833,6 +833,8 @@
>   		return -EINVAL;
>   	if (!!replace_prog != !!(flags & BPF_F_REPLACE))
>   		/* replace_prog implies BPF_F_REPLACE, and vice versa */
> +		return -EINVAL;
> +	if (!new_prog)
>   		return -EINVAL;
>   
>   	atype = bpf_cgroup_atype_find(type, new_prog->aux->attach_btf_id);
>
> --
> 2.43.0