* [PATCH] bpf: cgroup: fix null-ptr-deref in __cgroup_bpf_attach
@ 2026-09-02 9:02 Liu Jing
2026-09-02 9:41 ` Jiayuan Chen
2026-09-02 9:52 ` bot+bpf-ci
0 siblings, 2 replies; 4+ messages in thread
From: Liu Jing @ 2026-09-02 9:02 UTC (permalink / raw)
To: ast
Cc: daniel, andrii, eddyz87, memxor, martin.lau, song, yonghong.song,
jolsa, emil, ihor.solodrai, bpf, linux-kernel, Liu Jing
In __cgroup_bpf_attach(), the expression "prog ? : link->link.prog"
dereferences link before validating that link is non-NULL. If both
prog and link are NULL (a contract violation by the caller), this
causes a null pointer dereference.
Add a safe ternary fallback and a NULL check for new_prog before
it is used further.
Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
---
kernel/bpf/cgroup.c | 4 +++-
1 file changed, 3 insertion(+), 1 deletion(-)
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -814,7 +814,7 @@
struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
struct bpf_cgroup_storage *new_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
struct bpf_cgroup_storage *old_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
- struct bpf_prog *new_prog = prog ? : link->link.prog;
+ struct bpf_prog *new_prog = prog ? : (link ? link->link.prog : NULL);
enum cgroup_bpf_attach_type atype;
u32 old_flags, old_pl_flags;
struct bpf_prog_list *pl;
@@ -833,6 +833,8 @@
return -EINVAL;
if (!!replace_prog != !!(flags & BPF_F_REPLACE))
/* replace_prog implies BPF_F_REPLACE, and vice versa */
+ return -EINVAL;
+ if (!new_prog)
return -EINVAL;
atype = bpf_cgroup_atype_find(type, new_prog->aux->attach_btf_id);
--
2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] bpf: cgroup: fix null-ptr-deref in __cgroup_bpf_attach
2026-09-02 9:02 [PATCH] bpf: cgroup: fix null-ptr-deref in __cgroup_bpf_attach Liu Jing
@ 2026-09-02 9:41 ` Jiayuan Chen
2026-09-08 16:00 ` Emil Tsalapatis
2026-09-02 9:52 ` bot+bpf-ci
1 sibling, 1 reply; 4+ messages in thread
From: Jiayuan Chen @ 2026-09-02 9:41 UTC (permalink / raw)
To: Liu Jing, ast
Cc: daniel, andrii, eddyz87, memxor, martin.lau, song, yonghong.song,
jolsa, emil, ihor.solodrai, bpf, linux-kernel
on 9/2/26 5:02 PM, Liu Jing wrote:
> In __cgroup_bpf_attach(), the expression "prog ? : link->link.prog"
> dereferences link before validating that link is non-NULL. If both
> prog and link are NULL (a contract violation by the caller), this
> causes a null pointer dereference.
Both being NULL is unreachable, so the new check is dead code.
It's meaningless.
>
> Add a safe ternary fallback and a NULL check for new_prog before
> it is used further.
>
> Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
> ---
> kernel/bpf/cgroup.c | 4 +++-
> 1 file changed, 3 insertion(+), 1 deletion(-)
>
> --- a/kernel/bpf/cgroup.c
> +++ b/kernel/bpf/cgroup.c
> @@ -814,7 +814,7 @@
> struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
> struct bpf_cgroup_storage *new_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
> struct bpf_cgroup_storage *old_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
> - struct bpf_prog *new_prog = prog ? : link->link.prog;
> + struct bpf_prog *new_prog = prog ? : (link ? link->link.prog : NULL);
> enum cgroup_bpf_attach_type atype;
> u32 old_flags, old_pl_flags;
> struct bpf_prog_list *pl;
> @@ -833,6 +833,8 @@
> return -EINVAL;
> if (!!replace_prog != !!(flags & BPF_F_REPLACE))
> /* replace_prog implies BPF_F_REPLACE, and vice versa */
> + return -EINVAL;
> + if (!new_prog)
> return -EINVAL;
>
> atype = bpf_cgroup_atype_find(type, new_prog->aux->attach_btf_id);
>
> --
> 2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] bpf: cgroup: fix null-ptr-deref in __cgroup_bpf_attach
2026-09-02 9:41 ` Jiayuan Chen
@ 2026-09-08 16:00 ` Emil Tsalapatis
0 siblings, 0 replies; 4+ messages in thread
From: Emil Tsalapatis @ 2026-09-08 16:00 UTC (permalink / raw)
To: Jiayuan Chen
Cc: Liu Jing, ast, daniel, andrii, eddyz87, memxor, martin.lau, song,
yonghong.song, jolsa, ihor.solodrai, bpf, linux-kernel
+1, this patch implies the error is possible which afaict it isn't.
pw-bot: cr
On Wed, Sep 2, 2026 at 5:41 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>
>
> on 9/2/26 5:02 PM, Liu Jing wrote:
> > In __cgroup_bpf_attach(), the expression "prog ? : link->link.prog"
> > dereferences link before validating that link is non-NULL. If both
> > prog and link are NULL (a contract violation by the caller), this
> > causes a null pointer dereference.
>
>
> Both being NULL is unreachable, so the new check is dead code.
>
> It's meaningless.
>
>
> >
> > Add a safe ternary fallback and a NULL check for new_prog before
> > it is used further.
> >
> > Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
> > ---
> > kernel/bpf/cgroup.c | 4 +++-
> > 1 file changed, 3 insertion(+), 1 deletion(-)
> >
> > --- a/kernel/bpf/cgroup.c
> > +++ b/kernel/bpf/cgroup.c
> > @@ -814,7 +814,7 @@
> > struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
> > struct bpf_cgroup_storage *new_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
> > struct bpf_cgroup_storage *old_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
> > - struct bpf_prog *new_prog = prog ? : link->link.prog;
> > + struct bpf_prog *new_prog = prog ? : (link ? link->link.prog : NULL);
> > enum cgroup_bpf_attach_type atype;
> > u32 old_flags, old_pl_flags;
> > struct bpf_prog_list *pl;
> > @@ -833,6 +833,8 @@
> > return -EINVAL;
> > if (!!replace_prog != !!(flags & BPF_F_REPLACE))
> > /* replace_prog implies BPF_F_REPLACE, and vice versa */
> > + return -EINVAL;
> > + if (!new_prog)
> > return -EINVAL;
> >
> > atype = bpf_cgroup_atype_find(type, new_prog->aux->attach_btf_id);
> >
> > --
> > 2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] bpf: cgroup: fix null-ptr-deref in __cgroup_bpf_attach
2026-09-02 9:02 [PATCH] bpf: cgroup: fix null-ptr-deref in __cgroup_bpf_attach Liu Jing
2026-09-02 9:41 ` Jiayuan Chen
@ 2026-09-02 9:52 ` bot+bpf-ci
1 sibling, 0 replies; 4+ messages in thread
From: bot+bpf-ci @ 2026-09-02 9:52 UTC (permalink / raw)
To: liujing, ast
Cc: daniel, andrii, eddyz87, memxor, martin.lau, song, yonghong.song,
jolsa, emil, ihor.solodrai, bpf, linux-kernel, liujing, ast,
andrii, daniel, martin.lau, eddyz87, yonghong.song, mason,
ihor.solodrai
[-- Attachment #1: Type: text/plain, Size: 862 bytes --]
> bpf: cgroup: fix null-ptr-deref in __cgroup_bpf_attach
>
> In __cgroup_bpf_attach(), the expression "prog ? : link->link.prog"
> dereferences link before validating that link is non-NULL. If both
> prog and link are NULL (a contract violation by the caller), this
> causes a null pointer dereference.
>
> Add a safe ternary fallback and a NULL check for new_prog before
> it is used further.
>
> Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
This looks like a bug fix. Should this include:
Fixes: af6eea57437a ("bpf: Implement bpf_link-based cgroup BPF program attachment")
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/33613365877
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-08 16:00 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-02 9:02 [PATCH] bpf: cgroup: fix null-ptr-deref in __cgroup_bpf_attach Liu Jing
2026-09-02 9:41 ` Jiayuan Chen
2026-09-08 16:00 ` Emil Tsalapatis
2026-09-02 9:52 ` bot+bpf-ci
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®