Re: [PATCH bpf v5] bpf, cgroup: Fix storage null-ptr-deref after replacing prog

[bot+bpf-ci]

> commit c953408b860e553dc6831c7b95e870d0d1ef878d
> Author: Pu Lehui <pulehui@xxxxxxxxxx>
> Date:   Wed Aug 5 03:53:42 2026 +0000
>
>     bpf, cgroup: Fix storage null-ptr-deref after replacing prog
>
>     Syzkaller reported a storage null-ptr-deref issue after replacing prog.
>     This occurs in the following scenario:
>     1. prog A, an empty prog, is attached to a cgrp.
>     2. prog B uses BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE and calls the
>        bpf_get_local_storage helper.
>     3. link_update is called to replace prog A with prog B.
>
>     The reason is that __cgroup_bpf_replace fails to alloc and assign the
>     required cgrp storage for the incoming replacement prog. Consequently,
>     the new prog inherits an uninit storage, leading to null-ptr-deref panic
>     when kick the new prog.
>
>     Fix this by rejecting link update with -EPERM if new_prog's cgroup
>     storage is incompatible with link->prog.
>
>     Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link")
>     Reviewed-by: Amery Hung <ameryhung@xxxxxxxxx>
>     Signed-off-by: Pu Lehui <pulehui@xxxxxxxxxx>

The commit message says "Syzkaller reported" but there's no Reported-by
or Closes tag. Two public syzbot reports exist for this exact issue:

  - syzbot+4fe468a3f7fac86ea2c9@xxxxxxxxxxxxxxxxxxxxxxxxx
  - syzbot+e6e8f6618a2d4b35e4e0@xxxxxxxxxxxxxxxxxxxxxxxxx

Both reports contain KASAN null-ptr-deref traces at
____bpf_get_local_storage, and the public C reproducer matches the
described 3-step scenario exactly.

Should the commit include Reported-by and Closes tags so syzbot can
auto-close these reports?

> diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
> index 4355ccb78a9c..5cc9b2d92fd5 100644
> --- a/kernel/bpf/cgroup.c
> +++ b/kernel/bpf/cgroup.c

[ ... ]


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/30973728779