diff options
| author | Eduard Zingerman <eddyz87@gmail.com> | 2026-09-04 17:05:54 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-09-04 18:17:30 -0700 |
| commit | f1e418129f2ebb5376df2f1cd19720fa80f8adb4 (patch) | |
| tree | 1014f7b6324d46f07d016501547346a3727c78ed /scripts | |
| parent | 593c8eb0fb91a24c39244a7f9e7d04412d750544 (diff) | |
| download | linux-f1e418129f2ebb5376df2f1cd19720fa80f8adb4.tar.gz linux-f1e418129f2ebb5376df2f1cd19720fa80f8adb4.zip | |
bpf: mark a NULL memory argument of a call precise
check_mem_reg() allows bpf_register_is_null() for nullable arguments
w/o marking the underlying scalar register precise. Hence a checkpoint
created on such a path would prune against arbitrary scalar value.
The argument may live on the stack rather than in a register when a
call has more than MAX_BPF_FUNC_REG_ARGS arguments, hence the new
mark_arg_precision() helper.
Fixes: e5069b9c23b3 ("bpf: Support pointers in global func args")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-3-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions