diff options
| author | Amery Hung <ameryhung@gmail.com> | 2026-07-23 15:18:14 -0700 |
|---|---|---|
| committer | Eduard Zingerman <eddyz87@gmail.com> | 2026-07-23 16:09:07 -0700 |
| commit | 289e680c89ae8a0bb629fa8308313f5c8c6c76a3 (patch) | |
| tree | fec61c0877579c40642732193780ef8b9556ca97 | |
| parent | 94515f3a7d4256a5062176b7d6ed0471938cd51a (diff) | |
| download | linux-289e680c89ae8a0bb629fa8308313f5c8c6c76a3.tar.gz linux-289e680c89ae8a0bb629fa8308313f5c8c6c76a3.tar.bz2 linux-289e680c89ae8a0bb629fa8308313f5c8c6c76a3.zip | |
bpf: Reject passing scalar NULL to nonnull arg of a global subprog
A global subprogram argument tagged __arg_nonnull is set up as a
non-nullable PTR_TO_MEM. However the verifier does not check against a
scalar NULL, leading to real NULL pointer dereference. Reject it as
well.
Fixes: 94e1c70a3452 ("bpf: support 'arg:xxx' btf_decl_tag-based hints for global subprog args")
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260723221815.367797-1-ameryhung@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
| -rw-r--r-- | kernel/bpf/verifier.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 99444eae917e..7aa47342dc65 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -9189,7 +9189,8 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog, return ret; if (check_mem_reg(env, reg, argno, arg->mem_size)) return -EINVAL; - if (!(arg->arg_type & PTR_MAYBE_NULL) && (reg->type & PTR_MAYBE_NULL)) { + if (!(arg->arg_type & PTR_MAYBE_NULL) && + (type_may_be_null(reg->type) || bpf_register_is_null(reg))) { bpf_log(log, "%s is expected to be non-NULL\n", reg_arg_name(env, argno)); return -EINVAL; |