mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-11 01:10:54 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
ecdc5043794c9184aa8e6c814603899479c46b35
linux/kernel
History
Kumar Kartikeya Dwivedi ecdc504379 bpf: Mark NULL kptr stores precise 
check_map_kptr_access() permits a scalar store into an untrusted kptr
field only when the register is known to contain zero. Unlike other
verifier checks whose outcome depends on a scalar value, it does not mark
that register precise.

A state checkpoint reached with an imprecise zero can therefore prune a
second path that reaches the store with an arbitrary nonzero scalar. The
program can write attacker-controlled bits into the kptr field and load
them back as a PTR_TO_BTF_ID.

Call mark_chain_precision() before accepting a known-zero register. This
forces state equivalence to compare its scalar range and makes the verifier
visit and reject a path carrying a nonzero value.

Fixes: 61df10c779 ("bpf: Allow storing unreferenced kptr in map")
Reported-by: Nicholas Carlini <npc@anthropic.com>
Suggested-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904104203.345917-6-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-04 12:24:25 -07:00
..
bpf
bpf: Mark NULL kptr stores precise
2026-09-04 12:24:25 -07:00
cgroup
Merge branch 'sched/urgent'
2026-08-14 16:12:58 +02:00
configs
slab: support for compiler-assisted type-based slab cache partitioning
2026-05-14 10:44:09 +02:00
debug
kgdb: update outdated references to kgdb_wait()
2026-04-21 16:41:54 +01:00
dma
Merge tag 'dma-mapping-7.2-2026-06-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux
2026-06-17 12:20:21 -07:00
entry
entry: Rework trace_syscall_enter()
2026-07-20 20:38:40 +02:00
events
Merge tag 'perf-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-08-18 12:31:07 -07:00
futex
Merge tag 'locking-futex-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-08-18 15:26:35 -07:00
gcov
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
irq
Merge tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2026-08-20 08:16:04 -07:00
kcsan
kcsan: test: Adjust "expect" allocation type for kmalloc_obj
2026-02-26 09:54:08 -08:00
livepatch
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
liveupdate
Merge branch 'misc' into next
2026-08-04 10:51:49 +03:00
locking
irq,spin_lock: Add counted interrupt disabling/enabling
2026-08-10 10:50:18 +02:00
module
module: decompress: check return value of module_extend_max_pages()
2026-06-04 16:37:32 +00:00
power
PM: sleep: Allow disabling DPM watchdog by default
2026-07-23 15:46:34 +02:00
printk
printk: fix typos in comments
2026-06-02 15:36:06 +02:00
rcu
Merge tag 'timers-nohz-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip
2026-06-15 13:48:52 +05:30
sched
Merge tag 'timers-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-08-18 16:23:56 -07:00
time
Merge tag 'timers-vdso-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-08-18 16:56:25 -07:00
trace
Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2026-08-20 07:36:20 -07:00
unwind
Convert more 'alloc_obj' cases to default GFP_KERNEL arguments
2026-02-21 20:03:00 -08:00
.gitignore
kheaders: rebuild kheaders_data.tar.xz when a file is modified within a minute
2025-06-24 20:30:37 +09:00
acct.c
fs: move SB_I_USERNS_VISIBLE to FS_USERNS_MOUNT_RESTRICTED
2026-05-11 23:13:01 +02:00
async.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
audit_fsnotify.c
audit: fix recursive locking deadlock in audit_dupe_exe()
2026-05-27 19:15:34 -04:00
audit_tree.c
audit: use 'unsigned int' instead of 'unsigned'
2026-05-26 17:15:30 -04:00
audit_watch.c
audit: drop BUG_ON() from audit_add_to_parent()
2026-07-28 15:53:48 -04:00
audit.c
audit: fix potential integer overflow in audit_log_n_string()
2026-07-29 16:19:06 -04:00
audit.h
audit: fix recursive locking deadlock in audit_dupe_exe()
2026-05-27 19:15:34 -04:00
auditfilter.c
Merge tag 'audit-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
2026-08-19 16:21:32 -07:00
auditsc.c
audit: drop BUG_ON() from audit_signal_info_syscall()
2026-07-28 15:53:49 -04:00
backtracetest.c
…
bounds.c
x86/asm: Remove ANNOTATE_DATA_SPECIAL usage
2025-12-03 16:53:19 +01:00
capability.c
capability: Remove unused has_capability
2025-03-07 22:03:09 -06:00
cfi.c
cfi: Move BPF CFI types and helpers to generic code
2025-07-31 18:23:53 -07:00
compat.c
…
configs.c
…
context_tracking.c
context_tracking: Remove rcu_task_trace_heavyweight_{enter,exit}()
2026-01-01 16:39:46 +08:00
cpu_pm.c
syscore: Pass context data to callbacks
2025-11-14 10:01:52 +01:00
cpu.c
Merge tag 'smp-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-06-23 16:43:24 -07:00
crash_core_test.c
crash: add KUnit tests for crash_exclude_mem_range
2025-09-13 17:32:55 -07:00
crash_core.c
powerpc/kexec_file: Use crash_exclude_core_ranges() helper
2026-06-30 18:49:06 +03:00
crash_dump_dm_crypt.c
crash_dump: release keyring reference at the correct time
2026-07-13 10:04:47 +03:00
crash_reserve.c
kernel/crash: remove inclusion of crypto/sha1.h
2026-03-27 21:19:46 -07:00
cred.c
exec_state: relocate dumpable information
2026-05-26 11:02:01 +02:00
delayacct.c
delayacct: fix uapi timespec64 definition
2026-02-08 00:13:32 -08:00
dma.c
…
elfcorehdr.c
…
exec_domain.c
…
exec_state.c
exec_state: relocate dumpable information
2026-05-26 11:02:01 +02:00
exit.c
Merge tags 'ipc-7.3-rc1.misc' and 'kernel-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-08-17 08:27:30 -07:00
exit.h
…
extable.c
…
fail_function.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
fork.c
Merge tag 'smp-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-08-18 15:29:53 -07:00
freezer.c
freezer: Clarify that only cgroup1 freezer uses PM freezer
2025-10-30 20:10:27 +01:00
gen_kheaders.sh
kheaders: make it possible to override TAR
2025-08-06 10:23:36 +09:00
groups.c
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
hung_task.c
hung_task: explicitly report I/O wait state in log output
2026-03-27 21:19:40 -07:00
iomem.c
mm/memremap: Pass down MEMREMAP_* flags to arch_memremap_wb()
2025-02-21 15:05:38 +01:00
irq_work.c
irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT
2026-05-11 16:28:04 +02:00
jump_label.c
jump_label: use ATOMIC_INIT() for initialization of .enabled
2026-03-16 13:16:48 +01:00
kallsyms_internal.h
kallsyms: Get rid of kallsyms relative base
2026-01-22 15:58:22 -07:00
kallsyms_selftest.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
kallsyms_selftest.h
…
kallsyms.c
Merge tag 'mm-nonmm-stable-2026-02-12-10-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-02-12 12:13:01 -08:00
kcmp.c
fs: add real_fs to track task's actual fs_struct
2026-06-29 10:43:45 +02:00
Kconfig.freezer
…
Kconfig.hz
kernel: Fix "select" wording on HZ_250 description
2025-02-21 09:20:30 +01:00
Kconfig.kexec
liveupdate: kho: move to kernel/liveupdate
2025-11-27 14:24:33 -08:00
Kconfig.locks
locking/qspinlock: Add contended_release tracepoint
2026-08-07 17:58:10 +02:00
Kconfig.preempt
preempt: Introduce HAS_SEPARATE_PREEMPT_RESCHED_BITS
2026-08-10 10:50:19 +02:00
kcov.c
kcov: use WRITE_ONCE() for selftest mode stores
2026-06-04 14:49:26 -07:00
kexec_core.c
liveupdate: skip serialization for context-preserving kexec
2026-06-01 09:19:38 +03:00
kexec_elf.c
kexec: initialize ELF lowest address to ULONG_MAX
2025-03-16 22:30:47 -07:00
kexec_file.c
kexec_file: skip checksum verification when safe
2026-07-01 13:01:08 +03:00
kexec_internal.h
kexec: enable CMA based contiguous allocation
2025-08-02 12:01:38 -07:00
kexec.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
kheaders.c
…
kprobes.c
kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
2026-03-13 23:15:26 +09:00
kstack_erase.c
sysctl: remove __user qualifier from stack_erasing_sysctl buffer argument
2025-11-27 15:44:53 +01:00
ksyms_common.c
…
ksysfs.c
kernel: ksysfs: initialize kernel_kobj earlier
2026-04-03 19:39:52 +02:00
kthread.c
exec_state: relocate dumpable information
2026-05-26 11:02:01 +02:00
latencytop.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
Makefile
exec: introduce struct task_exec_state
2026-05-26 11:02:01 +02:00
module_signature.c
module: Give 'enum pkey_id_type' a more specific name
2026-03-24 21:42:37 +00:00
notifier.c
…
nscommon.c
nsfs: tighten permission checks for ns iteration ioctls
2026-02-27 22:00:08 +01:00
nsproxy.c
Merge tag 'vfs-7.1-rc1.mount.v2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-14 19:59:25 -07:00
nstree.c
nstree: tighten permission checks for listing
2026-02-27 22:00:11 +01:00
padata.c
padata: Put CPU offline callback in ONLINE section to allow failure
2026-03-22 11:17:59 +09:00
panic.c
bug/kunit: Core support for suppressing warning backtraces
2026-05-14 10:50:00 -06:00
params.c
kernel: param: initialize module_kset in a pure_initcall
2026-06-08 23:27:56 +02:00
pid_namespace.c
pid_namespace: allow opening pid_for_children before init was created
2026-03-20 14:44:26 +01:00
pid_sysctl.h
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
pid.c
pid: reject allocations through dead ancestor pid namespaces
2026-08-12 12:56:30 +02:00
profile.c
…
ptrace.c
exec_state: relocate dumpable information
2026-05-26 11:02:01 +02:00
range.c
…
reboot.c
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
regset.c
…
relay.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
resource_kunit.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
resource.c
resource: Make resource_alignment() input const resource
2026-06-23 12:08:51 -05:00
rseq.c
rseq: Reenable performance optimizations conditionally
2026-05-06 17:40:27 +02:00
scftorture.c
scftorture: Remove preempt_disable() in scftorture_invoke_one()
2026-07-16 09:24:56 +02:00
scs.c
scs: fix a wrong parameter in __scs_magic
2025-11-12 10:00:13 -08:00
seccomp.c
seccomp, treewide: Rename and convert __secure_computing() to return boolean
2026-07-12 12:38:02 +02:00
signal.c
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
2026-07-05 11:44:06 +02:00
smp.c
Merge tag 'smp-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2026-08-18 15:29:53 -07:00
smpboot.c
sched/smp: Use the SMP version of idle_thread_set_boot_cpu()
2025-06-13 08:47:20 +02:00
smpboot.h
…
softirq.c
preempt: Introduce HAS_SEPARATE_PREEMPT_RESCHED_BITS
2026-08-10 10:50:19 +02:00
stacktrace.c
…
static_call_inline.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
static_call.c
…
stop_machine.c
stop_machine: Make stop_one_cpu_nowait() return void
2026-07-31 12:35:26 +02:00
sys_ni.c
time: Respect COMPAT_32BIT_TIME for old time type functions
2026-07-07 23:52:53 +02:00
sys.c
exec_state: relocate dumpable information
2026-05-26 11:02:01 +02:00
sysctl-test.c
sysctl: move u8 register test to lib/test_sysctl.c
2025-04-14 14:13:41 +02:00
sysctl.c
sysctl: fix uninitialized variable in proc_do_large_bitmap
2026-03-26 09:32:19 +01:00
task_work.c
task_work: Fix NMI race condition
2025-10-29 10:29:54 +01:00
taskstats.c
taskstats: retain dead thread stats in TGID queries
2026-05-28 21:24:41 -07:00
torture.c
torture: Add torture_sched_set_normal() for user-specified nice values
2026-05-24 09:38:47 +02:00
tracepoint.c
tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
2026-04-14 05:17:02 -04:00
tsacct.c
tsacct: skip all kernel threads
2026-01-26 19:07:13 -08:00
ucount.c
binfmt_misc: correctly account pre-opened interpreters
2026-08-03 23:36:18 +02:00
uid16.c
…
uid16.h
…
umh.c
fs: add umh argument to struct kernel_clone_args
2026-06-29 10:54:41 +02:00
up.c
smp: Refactor remote CPU selection in smp_call_function_any()
2026-07-16 09:24:55 +02:00
user_namespace.c
Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses
2026-02-22 08:26:33 -08:00
user-return-notifier.c
…
user.c
binfmt_misc: use RCU for the handler lookup
2026-08-03 10:08:36 +02:00
utsname_sysctl.c
treewide: const qualify ctl_tables where applicable
2025-01-28 13:48:37 +01:00
utsname.c
Merge tag 'namespace-6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2025-09-29 11:20:29 -07:00
vhost_task.c
vhost_task_create: kill unnecessary .exit_signal initialization
2026-06-10 02:17:00 -04:00
vmcore_info.c
Merge tag 'mm-nonmm-stable-2026-04-15-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-16 20:11:56 -07:00
watch_queue.c
Convert 'alloc_flex' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
watchdog_buddy.c
watchdog/hardlockup: improve buddy system detection timeliness
2026-03-27 21:19:47 -07:00
watchdog_perf.c
watchdog/hardlockup: simplify perf event probe and remove per-cpu dependency
2026-02-08 00:13:35 -08:00
watchdog.c
watchdog/hardlockup: improve buddy system detection timeliness
2026-03-27 21:19:47 -07:00
workqueue_internal.h
workqueue: Show in-flight work item duration in stall diagnostics
2026-03-05 07:27:48 -10:00
workqueue.c
Merge tag 'wq-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
2026-06-17 11:57:44 +01:00