The function bpf_prog_dev_bound_destroy can potentially dereference
a NULL pointer when calling ondev->offdev. This patch adds a NULL check
for ondev to prevent such a dereference.

Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
 kernel/bpf/offload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
index 0ad97d643bf4..2a48dab16a22 100644
--- a/kernel/bpf/offload.c
+++ b/kernel/bpf/offload.c
@@ -383,7 +383,7 @@ void bpf_prog_dev_bound_destroy(struct bpf_prog *prog)
 		__bpf_prog_offload_destroy(prog);
 
 		ondev = bpf_offload_find_netdev(netdev);
-		if (!ondev->offdev && list_empty(&ondev->progs))
+		if (ondev && !ondev->offdev && list_empty(&ondev->progs))
 			__bpf_offload_dev_netdev_unregister(NULL, netdev);
 	}
 	up_write(&bpf_devs_lock);
-- 
2.43.0