[PATCH] bpf: Fix potential NULL pointer dereference in bpf_prog_dev_bound_destroy
From: Zhan Xusheng
Date: Thu Mar 05 2026 - 22:18:48 EST
The function bpf_prog_dev_bound_destroy can potentially dereference
a NULL pointer when calling ondev->offdev. This patch adds a NULL check
for ondev to prevent such a dereference.
Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
---
kernel/bpf/offload.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
index 0ad97d643bf4..2a48dab16a22 100644
--- a/kernel/bpf/offload.c
+++ b/kernel/bpf/offload.c
@@ -383,7 +383,7 @@ void bpf_prog_dev_bound_destroy(struct bpf_prog *prog)
__bpf_prog_offload_destroy(prog);
ondev = bpf_offload_find_netdev(netdev);
- if (!ondev->offdev && list_empty(&ondev->progs))
+ if (ondev && !ondev->offdev && list_empty(&ondev->progs))
__bpf_offload_dev_netdev_unregister(NULL, netdev);
}
up_write(&bpf_devs_lock);
--
2.43.0