Re: [PATCH bpf v4 4/4] bpf, cgroup: Fix storage null-ptr-deref after replacing prog

[Amery Hung <ameryhung@gmail.com>]

On 7/20/26 6:45 AM, Pu Lehui wrote:
> From: Pu Lehui <pulehui@huawei.com>
> 
> Syzkaller reported a storage null-ptr-deref issue after replacing prog.
> This occurs in the following scenario:
> 1. prog A, an empty prog, is attached to a cgrp.
> 2. prog B uses BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE and calls the
>     bpf_get_local_storage helper.
> 3. link_update is called to replace prog A with prog B.
> 
> The reason is that __cgroup_bpf_replace fails to alloc and assign the
> required cgrp storage for the incoming replacement prog. Consequently,
> the new prog inherits an uninit storage, leading to null-ptr-deref panic
> when kick the new prog.
> 
> Fix this by properly allocating the storage and comparing the old and
> new storage pointers. If the storage changed, fallback to
> update_effective_progs which performs a RCU-safe update of the entire
> array. If the storage remains unchanged, we can safely retain the
> fast-path in-place update.
> 
> Additionally, handle the error path in __cgroup_bpf_attach strictly.
> Although it is rare for update_effective_progs to fail in this context,
> proper rollbacks for storage and flags are added for code rigor.
> 
> Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link")
> Signed-off-by: Pu Lehui <pulehui@huawei.com>

Reviewed-by: Amery Hung <ameryhung@gmail.com>

[...]