Alexei StarovoitovandGreg Kroah-Hartman b52f6d0ef7 bpf: Fix regsafe() for pointers to packet ...

[ Upstream commit a8502a79e8 ]

In case rold->reg->range == BEYOND_PKT_END && rcur->reg->range == N
regsafe() may return true which may lead to current state with
valid packet range not being explored. Fix the bug.

Fixes: 6d94e741a8 ("bpf: Support for pointers beyond pkt_end.")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260331204228.26726-1-alexei.starovoitov@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-04-18 10:31:09 +02:00

..

preload

…

arraymap.c

bpf: Check percpu map value size first

2024-10-17 15:08:30 +02:00

bpf_inode_storage.c

…

bpf_iter.c

…

bpf_local_storage.c

bpf: Annotate data races in bpf_local_storage

2023-05-30 12:57:48 +01:00

bpf_lru_list.c

bpf: Address KCSAN report on bpf_lru_list

2023-07-27 08:44:38 +02:00

bpf_lru_list.h

bpf: Address KCSAN report on bpf_lru_list

2023-07-27 08:44:38 +02:00

bpf_lsm.c

…

bpf_struct_ops_types.h

…

bpf_struct_ops.c

…

btf.c

bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o

2024-08-19 05:40:48 +02:00

cgroup.c

bpf: Reject narrower access to pointer ctx fields

2026-02-06 16:40:09 +01:00

core.c

bpf: fix potential error return

2025-01-09 13:25:05 +01:00

cpumap.c

bpf: report RCU QS in cpumap kthread

2024-03-26 18:22:04 -04:00

devmap.c

bpf: fix OOB devmap writes when deleting elements

2024-12-14 19:48:24 +01:00

disasm.c

…

disasm.h

…

dispatcher.c

…

hashtab.c

bpf: Check percpu map value size first

2024-10-17 15:08:30 +02:00

helpers.c

bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers

2025-05-02 07:41:07 +02:00

inode.c

fs: add file and path permissions helpers

2024-06-21 14:52:58 +02:00

local_storage.c

…

lpm_trie.c

bpf: Fix exact match conditions in trie_get_next_key()

2024-12-14 19:48:22 +01:00

Makefile

…

map_in_map.c

bpf: Defer the free of inner map when necessary

2024-03-26 18:21:45 -04:00

map_in_map.h

bpf: Add map and need_defer parameters to .map_fd_put_ptr()

2024-02-23 08:42:07 +01:00

map_iter.c

…

net_namespace.c

…

offload.c

…

percpu_freelist.c

…

percpu_freelist.h

…

prog_iter.c

…

queue_stack_maps.c

bpf: Avoid deadlock when using queue and stack maps from NMI

2023-10-10 21:53:26 +02:00

reuseport_array.c

…

ringbuf.c

bpf: Sync pending IRQ work before freeing ring buffer

2025-12-07 06:08:07 +09:00

stackmap.c

bpf: Fix stackmap overflow check on 32-bit arches

2024-03-26 18:21:52 -04:00

syscall.c

bpf: avoid holding freeze_mutex during mmap operation

2025-05-02 07:41:06 +02:00

sysfs_btf.c

…

task_iter.c

file: Replace fcheck_files with files_lookup_fd_rcu

2024-06-21 14:52:48 +02:00

tnum.c

…

trampoline.c

x86/ibt,ftrace: Search for __fentry__ location

2024-10-17 15:07:37 +02:00

verifier.c

bpf: Fix regsafe() for pointers to packet

2026-04-18 10:31:09 +02:00