On 4/6/24 8:14 AM, Mikhail Lobanov wrote:

In the __cgroup_bpf_query() function, it is possible to dereference the null pointer in the line id = prog->aux->id; since there is no check for a non-zero value of the variable prog.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: af6eea57437a ("bpf: Implement bpf_link-based cgroup BPF program attachment") Cc: stable@vger.kernel.org Signed-off-by: Mikhail Lobanov m.lobanov@rosalinux.ru

---

kernel/bpf/cgroup.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 491d20038cbe..7f2db96f0c6a 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -1092,6 +1092,8 @@ static int __cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr, i = 0; hlist_for_each_entry(pl, progs, node) { prog = prog_list_prog(pl);

•           	       	if (!prog_list_prog(pl))
  

prog cannot be null. It is under cgroup_lock().

• 		continue;
  	id = prog->aux->id;
  	if (copy_to_user(prog_ids + i, &id, sizeof(id)))
  		return -EFAULT;