Amery Hung 289e680c89 bpf: Reject passing scalar NULL to nonnull arg of a global subprog ...

A global subprogram argument tagged __arg_nonnull is set up as a
non-nullable PTR_TO_MEM. However the verifier does not check against a
scalar NULL, leading to real NULL pointer dereference. Reject it as
well.

Fixes: 94e1c70a34 ("bpf: support 'arg:xxx' btf_decl_tag-based hints for global subprog args")
Signed-off-by: Amery Hung <[email protected]>
Acked-by: Eduard Zingerman <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Eduard Zingerman <[email protected]>

2026-07-23 16:09:07 -07:00

..

preload

…

arena.c

Merge tag 'mm-stable-2026-06-18-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-06-19 10:14:34 -07:00

arraymap.c

bpf: Cancel special fields on map value recycle

2026-06-09 21:23:11 -07:00

backtrack.c

bpf: Add precision marking and backtracking for stack argument slots

2026-05-13 09:27:30 -07:00

bloom_filter.c

…

bpf_cgrp_storage.c

bpf: Remove gfp_flags plumbing from bpf_local_storage_update()

2026-04-10 21:22:32 -07:00

bpf_inode_storage.c

bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

2026-06-30 16:31:56 +02:00

bpf_insn_array.c

…

bpf_iter.c

…

bpf_local_storage.c

bpf: Remove gfp_flags plumbing from bpf_local_storage_update()

2026-04-10 21:22:32 -07:00

bpf_lru_list.c

bpf: Fix NMI/tracepoint re-entry deadlock on lru locks

2026-06-07 18:46:13 -07:00

bpf_lru_list.h

bpf: Fix NMI/tracepoint re-entry deadlock on lru locks

2026-06-07 18:46:13 -07:00

bpf_lsm_proto.c

…

bpf_lsm.c

bpf: Disable xfrm_decode_session hook attachment

2026-06-22 20:08:37 -07:00

bpf_struct_ops.c

bpf: Add struct bpf_tramp_node object

2026-06-07 10:03:01 -07:00

bpf_task_storage.c

bpf: Remove gfp_flags plumbing from bpf_local_storage_update()

2026-04-10 21:22:32 -07:00

btf_iter.c

…

btf_relocate.c

…

btf.c

bpf: Fix tracing of kfuncs with implicit args

2026-07-16 16:11:29 -07:00

cfg.c

bpf: Check global subprog exception paths

2026-05-17 11:15:05 -07:00

cgroup_iter.c

…

cgroup.c

bpf: Fix effective prog array index with BPF_F_PREORDER

2026-06-21 18:10:04 -07:00

check_btf.c

bpf: Move BTF checking logic into check_btf.c

2026-04-12 12:37:04 -07:00

cnum_defs.h

bpf: Export cnum_umin/umax() helpers for netronome driver

2026-04-27 10:09:48 -07:00

cnum.c

bpf: representation and basic operations on circular numbers

2026-04-24 18:14:17 -07:00

const_fold.c

bpf: Extend liveness analysis to track stack argument slots

2026-05-13 09:27:31 -07:00

core.c

bpf: Prefer dirty packs for eBPF allocations

2026-07-01 10:34:41 +02:00

cpumap.c

…

cpumask.c

…

crypto.c

…

devmap.c

bpf: Run generic devmap egress prog on private skb

2026-06-12 18:21:01 -07:00

disasm.c

bpf: Mask pseudo pointer values in verifier logs

2026-06-25 17:59:04 -07:00

disasm.h

…

dispatcher.c

bpf: Restrict JIT predictor flush to cBPF

2026-07-01 10:33:38 +02:00

dmabuf_iter.c

…

fixups.c

bpf: Add support for tracing_multi link session

2026-06-07 10:03:01 -07:00

hashtab.c

bpf: Cancel special fields on map value recycle

2026-06-09 21:23:11 -07:00

helpers.c

Merge tag 'mm-nonmm-stable-2026-06-21-10-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-06-21 13:20:19 -07:00

inode.c

Merge tag 'bpf-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

2026-06-17 09:18:14 +01:00

Kconfig

…

kmem_cache_iter.c

…

link_iter.c

…

liveness.c

bpf: Fix arg_track_join log to use sa prefix for stack arg slots

2026-05-16 17:46:16 -07:00

local_storage.c

bpf: fix end-of-list detection in cgroup_storage_get_next_key()

2026-04-05 18:45:05 -07:00

log.c

bpf: Refactor object relationship tracking and fix dynptr UAF bug

2026-06-01 18:31:41 -07:00

lpm_trie.c

bpf: Allow LPM map access from sleepable BPF programs

2026-06-09 12:42:22 -07:00

Makefile

bpf: representation and basic operations on circular numbers

2026-04-24 18:14:17 -07:00

map_in_map.c

bpf: Reject exclusive maps as inner maps in map-in-map

2026-06-01 18:36:40 -07:00

map_in_map.h

…

map_iter.c

bpf: Implement iteration ops for resizable hashtab

2026-06-05 08:00:08 -07:00

memalloc.c

bpf: Retire rcu_trace_implies_rcu_gp()

2026-04-07 12:24:49 -07:00

mmap_unlock_work.h

…

mprog.c

…

net_namespace.c

…

offload.c

bpf: Fix use-after-free in offloaded map/prog info fill

2026-04-09 13:24:32 -07:00

percpu_freelist.c

…

percpu_freelist.h

…

prog_iter.c

…

queue_stack_maps.c

…

range_tree.c

…

range_tree.h

…

relo_core.c

…

reuseport_array.c

…

ringbuf.c

…

rqspinlock.c

…

rqspinlock.h

…

stackmap.c

bpf: Fix build_id caching in stack_map_get_build_id_offset()

2026-06-21 17:58:14 -07:00

states.c

bpf: Preserve pointer spill metadata during half-slot cleanup

2026-06-22 13:39:34 -07:00

stream.c

…

syscall.c

bpf: Fix BPF_PROG_ASSOC_STRUCT_OPS last field check

2026-06-21 18:09:07 -07:00

sysfs_btf.c

…

task_iter.c

bpf: return VMA snapshot from task_vma iterator

2026-04-10 12:05:16 -07:00

tcx.c

…

tnum.c

bpf: Simplify tnum_step()

2026-03-24 08:45:29 -07:00

token.c

…

trampoline.c

bpf: Add support for tracing_multi link session

2026-06-07 10:03:01 -07:00

verifier.c

bpf: Reject passing scalar NULL to nonnull arg of a global subprog

2026-07-23 16:09:07 -07:00