In __cgroup_bpf_attach(), the expression "prog ? : link->link.prog" dereferences link before validating that link is non-NULL. If both prog and link are NULL (a contract violation by the caller), this causes a null pointer dereference. Add a safe ternary fallback and a NULL check for new_prog before it is used further. Signed-off-by: Liu Jing --- kernel/bpf/cgroup.c | 4 +++- 1 file changed, 3 insertion(+), 1 deletion(-) --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -814,7 +814,7 @@ struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {}; struct bpf_cgroup_storage *new_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {}; struct bpf_cgroup_storage *old_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {}; - struct bpf_prog *new_prog = prog ? : link->link.prog; + struct bpf_prog *new_prog = prog ? : (link ? link->link.prog : NULL); enum cgroup_bpf_attach_type atype; u32 old_flags, old_pl_flags; struct bpf_prog_list *pl; @@ -833,6 +833,8 @@ return -EINVAL; if (!!replace_prog != !!(flags & BPF_F_REPLACE)) /* replace_prog implies BPF_F_REPLACE, and vice versa */ + return -EINVAL; + if (!new_prog) return -EINVAL; atype = bpf_cgroup_atype_find(type, new_prog->aux->attach_btf_id); -- 2.43.0