Eduard Zingerman 506ada8962 bpf: mark a NULL kfunc argument precise ...

check_kfunc_arg() allows bpf_register_is_null() for nullable arguments
w/o marking the underlying scalar register precise. Hence a checkpoint
created on such a path would prune against arbitrary scalar value.

Fixes: 3bda08b636 ("bpf: Allow NULL buffers in bpf_dynptr_slice(_rw)")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-5-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

2026-09-04 18:17:30 -07:00

..

preload

umd: Remove usermode driver framework

2025-07-26 21:03:04 +02:00

arena.c

bpf: Mark existing lock-safe kfuncs with KF_SPINLOCK_SAFE

2026-08-06 10:58:04 +02:00

arraymap.c

bpf: Fix percpu map update indexing with sparse CPU IDs

2026-08-21 10:41:27 -07:00

backtrack.c

bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks

2026-09-02 11:13:21 -07:00

bloom_filter.c

bpf: Harden bloom filter sizing and indexing on 32-bit kernels

2026-08-05 11:45:20 -07:00

bpf_cgrp_storage.c

bpf: Remove gfp_flags plumbing from bpf_local_storage_update()

2026-04-10 21:22:32 -07:00

bpf_inode_storage.c

bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

2026-06-30 16:31:56 +02:00

bpf_insn_array.c

bpf: Lose const-ness of map in map_check_btf()

2026-02-27 15:39:00 -08:00

bpf_iter.c

bpf: Inline bpf_iter_num_destroy() as a no-op

2026-08-05 10:44:35 -07:00

bpf_local_storage.c

bpf: Remove gfp_flags plumbing from bpf_local_storage_update()

2026-04-10 21:22:32 -07:00

bpf_lru_list.c

bpf: Fix NMI/tracepoint re-entry deadlock on lru locks

2026-06-07 18:46:13 -07:00

bpf_lru_list.h

bpf: Fix NMI/tracepoint re-entry deadlock on lru locks

2026-06-07 18:46:13 -07:00

bpf_lsm_proto.c

bpf: annotate file argument as __nullable in bpf_lsm_mmap_file

2025-12-21 10:56:33 -08:00

bpf_lsm.c

bpf: Rename ARG_CONST_SIZE{,_OR_ZERO} to ARG_MEM_SIZE{,_OR_ZERO}

2026-08-03 00:29:14 +02:00

bpf_struct_ops.c

bpf: Support __arena and __arena__nullable on struct_ops arguments

2026-08-08 03:03:26 -07:00

bpf_task_storage.c

bpf: Remove gfp_flags plumbing from bpf_local_storage_update()

2026-04-10 21:22:32 -07:00

btf_iter.c

…

btf_relocate.c

…

btf.c

bpf: Mark bpf_btf_find_by_name_kind() as sleepable

2026-09-03 19:22:52 -07:00

cfg.c

bpf: don't rewrite bpf_fastcall patterns entered by a jump

2026-09-03 18:55:40 -07:00

cgroup_iter.c

bpf: add new BPF_CGROUP_ITER_CHILDREN control option

2026-01-27 09:05:54 -08:00

cgroup.c

bpf: Reject negative optlen in cgroup getsockopt hook

2026-08-17 11:33:29 +02:00

check_btf.c

bpf: Rename 'early' BTF checking as a preparation phase

2026-08-08 03:03:25 -07:00

cnum_defs.h

bpf: Export cnum_umin/umax() helpers for netronome driver

2026-04-27 10:09:48 -07:00

cnum.c

bpf: representation and basic operations on circular numbers

2026-04-24 18:14:17 -07:00

const_fold.c

bpf: Introduce global percpu data

2026-08-13 10:27:40 -07:00

core.c

x86/bpf: Make arch_bpf_trampoline_size allocate from EXECMEM_MODULE_DATA

2026-08-20 17:52:31 +02:00

cpumap.c

bpf: Add missing XDP_ABORTED handling in cpumap

2026-03-03 08:37:21 -08:00

cpumask.c

bpf: Require a BPF cpumask for bpf_cpumask_populate()

2026-07-12 01:52:36 +02:00

crypto.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

devmap.c

bpf: Run generic devmap egress prog on private skb

2026-06-12 18:21:01 -07:00

diagnostics.c

bpf: Preserve source attribution without source text

2026-08-17 11:58:23 +02:00

diagnostics.h

bpf: Report Policy helper and kfunc errors

2026-08-15 11:15:17 -07:00

disasm.c

bpf: update disasm.c to print BPF_PROBE_ATOMIC as atomics

2026-09-03 18:54:45 -07:00

disasm.h

…

dispatcher.c

bpf: dispatcher: Allocate bpf_dispatcher->rw_image with vzalloc()

2026-07-22 17:26:39 +02:00

dmabuf_iter.c

bpf: Fix truncated dmabuf iterator reads

2025-12-09 23:48:34 -08:00

fixups.c

bpf: zero extend the result of an arena 32-bit cmpxchg

2026-09-03 18:54:45 -07:00

hashtab.c

bpf: Cancel special fields when recycling rhtab elements

2026-09-04 12:24:24 -07:00

helpers.c

bpf: Fix arm64 KASAN false positive after bpf_throw

2026-08-14 18:26:14 +02:00

inode.c

Merge tag 'bpf-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

2026-06-17 09:18:14 +01:00

Kconfig

bpf: Update the bpf_prog_calc_tag to use SHA256

2025-09-18 19:10:20 -07:00

kmem_cache_iter.c

bpf: Add open coded version of kmem_cache iterator

2024-11-01 11:08:32 -07:00

link_iter.c

bpf: Clean up individual BTF_ID code

2025-07-16 18:34:42 -07:00

liveness.c

bpf: Drop duplicate blank lines in kernel/bpf/

2026-08-13 10:27:40 -07:00

local_storage.c

bpf: Fix percpu map update indexing with sparse CPU IDs

2026-08-21 10:41:27 -07:00

log.c

bpf: Track verifier register diagnostic events

2026-08-15 11:11:16 -07:00

lpm_trie.c

bpf: Allow LPM map access from sleepable BPF programs

2026-06-09 12:42:22 -07:00

Makefile

bpf: Add verifier diagnostics report helpers

2026-08-15 11:11:16 -07:00

map_in_map.c

bpf: Reject exclusive maps as inner maps in map-in-map

2026-06-01 18:36:40 -07:00

map_in_map.h

…

map_iter.c

bpf: Implement iteration ops for resizable hashtab

2026-06-05 08:00:08 -07:00

memalloc.c

bpf: Retire rcu_trace_implies_rcu_gp()

2026-04-07 12:24:49 -07:00

mmap_unlock_work.h

bpf: Fix mmap_lock leak in irq_work path

2026-08-08 10:25:36 +02:00

mprog.c

…

net_namespace.c

bpf: Fix potential UAF in bpf_netns_link_update_prog

2026-07-30 15:28:46 -07:00

offload.c

bpf: Fix use-after-free in offloaded map/prog info fill

2026-04-09 13:24:32 -07:00

percpu_freelist.c

bpf: Fix infinite loop in pcpu_freelist push with one possible CPU

2026-08-20 20:44:16 +02:00

percpu_freelist.h

bpf: Fix infinite loop in pcpu_freelist push with one possible CPU

2026-08-20 20:44:16 +02:00

prog_iter.c

bpf: Clean up individual BTF_ID code

2025-07-16 18:34:42 -07:00

queue_stack_maps.c

bpf: Drop duplicate blank lines in kernel/bpf/

2026-08-13 10:27:40 -07:00

range_tree.c

bpf: arena: Reintroduce memcg accounting

2026-01-02 14:31:59 -08:00

range_tree.h

bpf: Introduce range_tree data structure and use it in bpf arena

2024-11-13 13:52:45 -08:00

relo_core.c

…

reuseport_array.c

…

ringbuf.c

bpf: Fix available-data accounting on 32-bit wrap in overwrite mode

2026-08-14 15:20:37 -07:00

rqspinlock.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc7

2026-08-07 23:04:17 +02:00

rqspinlock.h

rqspinlock: Protect waiters in queue from stalls

2025-03-19 08:03:05 -07:00

stackmap.c

bpf: Mark faultable stack helpers as sleepable

2026-09-03 19:22:52 -07:00

states.c

bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO

2026-08-28 10:44:21 -07:00

stream.c

bpf: Add bpf_stream_print_stack stack dumping kfunc

2026-02-03 10:41:16 -08:00

syscall.c

bpf: Mark syscall helpers as sleepable

2026-09-03 09:44:55 -07:00

sysfs_btf.c

Merge tag 'driver-core-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

2025-07-29 12:15:39 -07:00

task_iter.c

bpf: Fix mmap_lock leak in irq_work path

2026-08-08 10:25:36 +02:00

tcx.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

tnum.c

bpf: Simplify tnum_step()

2026-03-24 08:45:29 -07:00

token.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

trampoline.c

bpf: Make bpf_trampoline_multi_detach return void

2026-08-13 02:52:23 +02:00

verifier.c

bpf: mark a NULL kfunc argument precise

2026-09-04 18:17:30 -07:00