Mitigate a possible NULL pointer dereference in bpf_get_local_storage() by requiring all callers to use cgroup storage if the owner does. Cgroup storage is allocated lazily when attaching a cgroup bpf program. With tail call, it is possible for a callee BPF program to see a NULL storage pointer if the caller prorgam does not use cgroup storage. Reported-by: Yinhao Hu Reported-by: Kaiyan Mei Reported-by: Dongliang Mu Closes: https://lore.kernel.org/bpf/c9ac63d7-73be-49c5-a4ac-eb07f7521adb@hust.edu.cn/ Signed-off-by: Amery Hung --- kernel/bpf/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index c8ae6ab31651..e249ea98f55d 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2403,8 +2403,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, break; cookie = aux->cgroup_storage[i] ? aux->cgroup_storage[i]->cookie : 0; - ret = map->owner->storage_cookie[i] == cookie || - !cookie; + ret = map->owner->storage_cookie[i] == cookie; } if (ret && map->owner->attach_func_proto != aux->attach_func_proto) { -- 2.47.3