[PATCH] bpf: cgroup: fix null-ptr-deref in __cgroup_bpf_attach

[Liu Jing]

In __cgroup_bpf_attach(), the expression "prog ? : link->link.prog"
dereferences link before validating that link is non-NULL. If both
prog and link are NULL (a contract violation by the caller), this
causes a null pointer dereference.

Add a safe ternary fallback and a NULL check for new_prog before
it is used further.

Signed-off-by: Liu Jing <liujing@xxxxxxxxxxxxxxxxxxxx>
---
 kernel/bpf/cgroup.c | 4 +++-
 1 file changed, 3 insertion(+), 1 deletion(-)

--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -814,7 +814,7 @@
 	struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
 	struct bpf_cgroup_storage *new_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
 	struct bpf_cgroup_storage *old_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {};
-	struct bpf_prog *new_prog = prog ? : link->link.prog;
+	struct bpf_prog *new_prog = prog ? : (link ? link->link.prog : NULL);
 	enum cgroup_bpf_attach_type atype;
 	u32 old_flags, old_pl_flags;
 	struct bpf_prog_list *pl;
@@ -833,6 +833,8 @@
 		return -EINVAL;
 	if (!!replace_prog != !!(flags & BPF_F_REPLACE))
 		/* replace_prog implies BPF_F_REPLACE, and vice versa */
+		return -EINVAL;
+	if (!new_prog)
 		return -EINVAL;
 
 	atype = bpf_cgroup_atype_find(type, new_prog->aux->attach_btf_id);

--
2.43.0