Qi Tang 10bc4a4dcd bpf: reject direct access to nullable PTR_TO_BUF pointers ...

[ Upstream commit b0db1accbc ]

check_mem_access() matches PTR_TO_BUF via base_type() which strips
PTR_MAYBE_NULL, allowing direct dereference without a null check.

Map iterator ctx->key and ctx->value are PTR_TO_BUF | PTR_MAYBE_NULL.
On stop callbacks these are NULL, causing a kernel NULL dereference.

Add a type_may_be_null() guard to the PTR_TO_BUF branch, matching the
existing PTR_TO_BTF_ID pattern.

Fixes: 20b2aff4bc ("bpf: Introduce MEM_RDONLY flag")
Signed-off-by: Qi Tang <tpluszz77@gmail.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260402092923.38357-2-tpluszz77@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-04-18 10:33:31 +02:00

..

bpf

bpf: reject direct access to nullable PTR_TO_BUF pointers

2026-04-18 10:33:31 +02:00

cgroup

cgroup: fix race between task migration and iteration

2026-04-18 10:33:13 +02:00

configs

…

debug

kdb: Do not assume write() callback available

2025-03-13 12:50:45 +01:00

dma

dma/pool: distinguish between missing and exhausted atomic pools

2026-02-06 16:42:00 +01:00

entry

…

events

uprobe: Do not emulate/sstep original instruction when ip is changed

2025-12-07 06:09:17 +09:00

futex

futex: Clear stale exiting pointer in futex_lock_pi() retry path

2026-04-18 10:33:28 +02:00

gcov

gcov: add support for GCC 15

2025-12-07 06:09:29 +09:00

irq

genirq/irq_sim: Initialize work context pointers properly

2026-02-06 16:42:05 +01:00

kcsan

kcsan: Turn report_filterlist_lock into a raw_spinlock

2024-12-14 19:51:35 +01:00

livepatch

livepatch: Match old_sympos 0 and 1 in klp_find_func()

2026-01-19 13:09:42 +01:00

locking

locking/spinlock/debug: Fix data-race in do_raw_write_lock

2026-01-19 13:09:19 +01:00

power

PM: sleep: console: Fix the black screen issue

2025-08-28 16:24:18 +02:00

printk

printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX

2025-03-13 12:50:17 +01:00

rcu

rcu: Protect ->defer_qs_iw_pending from data race

2025-08-28 16:24:20 +02:00

sched

sched: idle: Consolidate the handling of two special cases

2026-04-18 10:33:21 +02:00

time

alarmtimer: Fix argument order in alarm_timer_forward()

2026-04-18 10:33:27 +02:00

trace

tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G

2026-04-18 10:33:15 +02:00

.gitignore

…

acct.c

acct: block access to kernel internal filesystems

2025-03-13 12:50:54 +01:00

async.c

…

audit_fsnotify.c

…

audit_tree.c

…

audit_watch.c

…

audit.c

…

audit.h

…

auditfilter.c

ima: Avoid blocking in RCU read-side critical section

2024-07-18 13:07:34 +02:00

auditsc.c

…

backtracetest.c

…

bounds.c

…

capability.c

…

cfi.c

…

compat.c

…

configs.c

…

context_tracking.c

…

cpu_pm.c

…

cpu.c

hrtimers: Handle CPU state correctly on hotplug

2025-01-23 17:16:02 +01:00

crash_core.c

…

crash_dump.c

…

cred.c

…

delayacct.c

…

dma.c

…

exec_domain.c

…

exit.c

perf: Fix sample vs do_exit()

2025-06-27 11:05:38 +01:00

extable.c

…

fail_function.c

…

fork.c

unshare: fix unshare_fs() handling

2026-04-18 10:33:11 +02:00

freezer.c

…

gen_kheaders.sh

kheaders: Ignore silly-rename files

2025-01-23 17:16:00 +01:00

groups.c

…

hung_task.c

hung_task: move hung_task sysctl interface to hung_task.c

2025-03-13 12:49:50 +01:00

iomem.c

…

irq_work.c

…

jump_label.c

…

kallsyms.c

…

kcmp.c

…

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

…

Kconfig.preempt

…

kcov.c

kcov: mark in_softirq_really() as __always_inline

2025-01-09 13:28:50 +01:00

kexec_core.c

…

kexec_elf.c

kexec: initialize ELF lowest address to ULONG_MAX

2025-04-10 14:32:01 +02:00

kexec_file.c

kexec: derive purgatory entry from symbol

2026-03-04 07:20:32 -05:00

kexec_internal.h

…

kexec.c

…

kheaders.c

…

kmod.c

…

kprobes.c

kprobes: Fix to check symbol prefixes correctly

2024-08-19 05:45:42 +02:00

ksysfs.c

…

kthread.c

kthread: unpark only parked kthread

2024-10-17 15:12:00 +02:00

latencytop.c

…

Makefile

…

module_signature.c

…

module_signing.c

…

module-internal.h

…

module.c

module: Fix kernel panic when a symbol st_shndx is out of bounds

2026-04-18 10:33:23 +02:00

notifier.c

…

nsproxy.c

…

padata.c

padata: Reset next CPU when reorder sequence wraps around

2025-10-29 14:03:14 +01:00

panic.c

…

params.c

module: ensure that kobject_put() is safe for module type kobjects

2025-05-18 08:20:37 +02:00

pid_namespace.c

…

pid.c

pid: Add a judgment for ns null in pid_nr_ns

2025-10-19 16:21:54 +02:00

profile.c

profiling: remove profile=sleep support

2024-08-19 05:45:39 +02:00

ptrace.c

…

range.c

…

reboot.c

…

regset.c

…

relay.c

…

resource_kunit.c

…

resource.c

resource: fix region_intersects() vs add_memory_driver_managed()

2024-10-17 15:11:59 +02:00

rseq.c

rseq: Fix segfault on registration when rseq_cs is non-zero

2025-07-17 18:30:55 +02:00

scftorture.c

…

scs.c

scs: fix a wrong parameter in __scs_magic

2026-01-19 13:09:52 +01:00

seccomp.c

…

signal.c

signal: Replace BUG_ON()s

2024-10-17 15:11:27 +02:00

smp.c

smp: Fix up and expand the smp_call_function_many() kerneldoc

2025-10-19 16:21:31 +02:00

smpboot.c

…

smpboot.h

…

softirq.c

lockdep: Fix wait context check on softirq for PREEMPT_RT

2025-06-04 14:37:55 +02:00

stackleak.c

…

stacktrace.c

…

static_call_inline.c

x86/static-call: provide a way to do very early static-call updates

2024-12-19 18:07:22 +01:00

static_call.c

…

stop_machine.c

…

sys_ni.c

syscalls: fix compat_sys_io_pgetevents_time64 usage

2024-07-05 09:14:50 +02:00

sys.c

…

sysctl-test.c

…

sysctl.c

sysctl: fix uninitialized variable in proc_do_large_bitmap

2026-04-18 10:33:27 +02:00

task_work.c

task_work: Introduce task_work_cancel() again

2024-08-19 05:45:13 +02:00

taskstats.c

…

test_kprobes.c

…

torture.c

…

tracepoint.c

…

tsacct.c

…

ucount.c

ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()

2026-03-04 07:19:35 -05:00

uid16.c

…

uid16.h

…

umh.c

…

up.c

…

user_namespace.c

…

user-return-notifier.c

…

user.c

…

usermode_driver.c

…

utsname_sysctl.c

…

utsname.c

…

watch_queue.c

watch_queue: fix pipe accounting mismatch

2025-04-10 14:31:57 +02:00

watchdog_hld.c

watchdog/perf: properly initialize the turbo mode timestamp and rearm counter

2024-08-19 05:45:20 +02:00

watchdog.c

…

workqueue_internal.h

…

workqueue.c

workqueue: Improve scalability of workqueue watchdog touch

2024-09-12 11:07:52 +02:00