Re: [PATCH bpf v5] bpf, cgroup: Fix storage null-ptr-deref after replacing prog

[Pu Lehui]

On 2026/8/5 12:59, Leon Hwang wrote:
> On 5/8/26 11:53, Pu Lehui wrote:
> > From: Pu Lehui <pulehui@xxxxxxxxxx>
> >
> > Syzkaller reported a storage null-ptr-deref issue after replacing prog.
> > This occurs in the following scenario:
> > 1. prog A, an empty prog, is attached to a cgrp.
> > 2. prog B uses BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE and calls the
> >     bpf_get_local_storage helper.
> > 3. link_update is called to replace prog A with prog B.
> >
> > The reason is that __cgroup_bpf_replace fails to alloc and assign the
> > required cgrp storage for the incoming replacement prog. Consequently,
> > the new prog inherits an uninit storage, leading to null-ptr-deref panic
> > when kick the new prog.
> >
> > Fix this by rejecting link update with -EPERM if new_prog's cgroup
> > storage is incompatible with link->prog.
> >
> > Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link")
> > Reviewed-by: Amery Hung <ameryhung@xxxxxxxxx>
> > Signed-off-by: Pu Lehui <pulehui@xxxxxxxxxx>
>
>
> Looks much simpler than the previous versions.
>
> Other than the -EPERM in the commit msg, lgtm.

Thanks review, I'd better send a new version first.

> Acked-by: Leon Hwang <leon.hwang@xxxxxxxxx>
>
> > [...]