Alexei Starovoitov b52f6d0ef7 bpf: Fix regsafe() for pointers to packet ...

[ Upstream commit a8502a79e8 ]

In case rold->reg->range == BEYOND_PKT_END && rcur->reg->range == N
regsafe() may return true which may lead to current state with
valid packet range not being explored. Fix the bug.

Fixes: 6d94e741a8 ("bpf: Support for pointers beyond pkt_end.")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260331204228.26726-1-alexei.starovoitov@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-04-18 10:31:09 +02:00

..

bpf

bpf: Fix regsafe() for pointers to packet

2026-04-18 10:31:09 +02:00

cgroup

cgroup: fix race between task migration and iteration

2026-04-18 10:30:54 +02:00

configs

…

debug

kdb: Do not assume write() callback available

2025-03-13 12:47:22 +01:00

dma

dma/pool: distinguish between missing and exhausted atomic pools

2026-02-06 16:40:11 +01:00

entry

…

events

uprobe: Do not emulate/sstep original instruction when ip is changed

2025-12-07 06:08:10 +09:00

futex

futex: Clear stale exiting pointer in futex_lock_pi() retry path

2026-04-18 10:31:08 +02:00

gcov

gcov: add support for GCC 15

2025-12-07 06:08:19 +09:00

irq

genirq: Provide new interfaces for affinity hints

2025-10-02 13:35:39 +02:00

kcsan

kcsan: Turn report_filterlist_lock into a raw_spinlock

2024-12-14 19:48:25 +01:00

livepatch

livepatch: Match old_sympos 0 and 1 in klp_find_func()

2026-01-19 13:11:41 +01:00

locking

locking/spinlock/debug: Fix data-race in do_raw_write_lock

2026-01-19 13:11:25 +01:00

power

PM: sleep: console: Fix the black screen issue

2025-08-28 16:22:41 +02:00

printk

printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX

2025-03-13 12:47:01 +01:00

rcu

rcu: Protect ->defer_qs_iw_pending from data race

2025-08-28 16:22:42 +02:00

sched

sched: idle: Consolidate the handling of two special cases

2026-04-18 10:31:02 +02:00

time

alarmtimer: Fix argument order in alarm_timer_forward()

2026-04-18 10:31:07 +02:00

trace

tracing: Fix syscall events activation by ensuring refcount hits zero

2026-04-18 10:30:59 +02:00

.gitignore

…

acct.c

acct: perform last write from workqueue

2025-03-13 12:47:35 +01:00

async.c

async: Introduce async_schedule_dev_nocall()

2024-02-23 08:41:53 +01:00

audit_fsnotify.c

fsnotify: make allow_dups a property of the group

2024-06-21 14:53:39 +02:00

audit_tree.c

fsnotify: pass flags argument to fsnotify_alloc_group()

2024-06-21 14:53:39 +02:00

audit_watch.c

fsnotify: pass flags argument to fsnotify_alloc_group()

2024-06-21 14:53:39 +02:00

audit.c

audit: Send netlink ACK before setting connection in auditd_set

2024-02-23 08:42:03 +01:00

audit.h

…

auditfilter.c

ima: Avoid blocking in RCU read-side critical section

2024-07-18 13:05:44 +02:00

auditsc.c

audit: fix possible soft lockup in __audit_inode_child()

2023-09-19 12:20:13 +02:00

backtracetest.c

…

bounds.c

bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS

2024-05-02 16:23:46 +02:00

capability.c

…

compat.c

sched_getaffinity: don't assume 'cpumask_size()' is fully initialized

2023-04-05 11:23:45 +02:00

configs.c

…

context_tracking.c

…

cpu_pm.c

…

cpu.c

hrtimers: Handle CPU state correctly on hotplug

2025-02-01 18:22:29 +01:00

crash_core.c

…

crash_dump.c

…

cred.c

cred: switch to using atomic_long_t

2023-12-20 15:44:30 +01:00

delayacct.c

…

dma.c

…

exec_domain.c

…

exit.c

perf: Fix sample vs do_exit()

2025-06-27 11:04:24 +01:00

extable.c

…

fail_function.c

…

fork.c

unshare: fix unshare_fs() handling

2026-04-18 10:30:52 +02:00

freezer.c

…

gen_kheaders.sh

kheaders: Ignore silly-rename files

2025-02-01 18:22:28 +01:00

groups.c

…

hung_task.c

…

iomem.c

…

irq_work.c

…

jump_label.c

…

kallsyms.c

kallsyms: Make kallsyms_on_each_symbol generally available

2024-10-17 15:08:29 +02:00

kcmp.c

kcmp: In get_file_raw_ptr use task_lookup_fd_rcu

2024-06-21 14:52:48 +02:00

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

…

Kconfig.preempt

…

kcov.c

kcov: don't lose track of remote references during softirqs

2024-07-05 09:12:41 +02:00

kexec_core.c

kexec: fix a memory leak in crash_shrink_memory()

2023-07-27 08:43:40 +02:00

kexec_elf.c

kexec: initialize ELF lowest address to ULONG_MAX

2025-04-10 14:30:58 +02:00

kexec_file.c

kexec: derive purgatory entry from symbol

2026-03-04 07:20:21 -05:00

kexec_internal.h

panic, kexec: make __crash_kexec() NMI safe

2023-04-20 12:10:29 +02:00

kexec.c

panic, kexec: make __crash_kexec() NMI safe

2023-04-20 12:10:29 +02:00

kheaders.c

kheaders: Use array declaration instead of char

2023-05-17 11:47:33 +02:00

kmod.c

…

kprobes.c

x86/ibt,ftrace: Search for __fentry__ location

2024-10-17 15:07:37 +02:00

ksysfs.c

kexec: turn all kexec_mutex acquisitions into trylocks

2023-04-20 12:10:29 +02:00

kthread.c

kthread: fix task state in kthread worker if being frozen

2024-10-17 15:07:50 +02:00

latencytop.c

…

Makefile

…

module_signature.c

…

module_signing.c

…

module-internal.h

…

module.c

kallsyms: Make module_kallsyms_on_each_symbol generally available

2024-10-17 15:08:29 +02:00

notifier.c

…

nsproxy.c

…

padata.c

padata: Reset next CPU when reorder sequence wraps around

2025-10-29 14:01:23 +01:00

panic.c

panic: Flush kernel log buffer at the end

2024-04-13 12:59:40 +02:00

params.c

module: ensure that kobject_put() is safe for module type kobjects

2025-06-04 14:36:55 +02:00

pid_namespace.c

zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING

2024-07-05 09:12:33 +02:00

pid.c

pid: Add a judgment for ns null in pid_nr_ns

2025-10-29 14:01:14 +01:00

profile.c

kernel: Initialize cpumask before parsing

2025-01-09 13:25:04 +01:00

ptrace.c

…

range.c

…

reboot.c

kernel/reboot: emergency_restart: Set correct system_state

2023-11-28 16:54:58 +00:00

regset.c

…

relay.c

relayfs: fix out-of-bounds access in relay_file_read

2023-05-17 11:47:34 +02:00

resource.c

kernel/resource: fix kfree() of bootmem memory again

2025-05-02 07:41:09 +02:00

rseq.c

rseq: Fix segfault on registration when rseq_cs is non-zero

2025-07-17 18:28:01 +02:00

scftorture.c

scftorture: Forgive memory-allocation failure if KASAN

2023-09-23 11:01:05 +02:00

scs.c

scs: fix a wrong parameter in __scs_magic

2026-01-19 13:11:50 +01:00

seccomp.c

seccomp: Invalidate seccomp mode to catch death failures

2024-03-01 13:16:46 +01:00

signal.c

signal: Replace BUG_ON()s

2024-10-17 15:08:12 +02:00

smp.c

smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()

2024-09-12 11:06:48 +02:00

smpboot.c

…

smpboot.h

…

softirq.c

…

stackleak.c

…

stacktrace.c

…

static_call.c

x86/static-call: provide a way to do very early static-call updates

2024-12-19 18:06:13 +01:00

stop_machine.c

…

sys_ni.c

syscalls: fix compat_sys_io_pgetevents_time64 usage

2024-07-05 09:12:55 +02:00

sys.c

fs: add file and path permissions helpers

2024-06-21 14:52:58 +02:00

sysctl-test.c

…

sysctl.c

sysctl: fix uninitialized variable in proc_do_large_bitmap

2026-04-18 10:31:06 +02:00

task_work.c

task_work: Introduce task_work_cancel() again

2024-08-19 05:40:57 +02:00

taskstats.c

…

test_kprobes.c

…

torture.c

torture: Fix hang during kthread shutdown phase

2023-08-30 16:23:17 +02:00

tracepoint.c

…

tsacct.c

…

ucount.c

ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()

2026-03-04 07:19:35 -05:00

uid16.c

…

uid16.h

…

umh.c

…

up.c

…

user_namespace.c

…

user-return-notifier.c

…

user.c

…

usermode_driver.c

…

utsname_sysctl.c

…

utsname.c

…

watch_queue.c

watch_queue: fix pipe accounting mismatch

2025-04-10 14:30:55 +02:00

watchdog_hld.c

watchdog/perf: properly initialize the turbo mode timestamp and rearm counter

2024-08-19 05:41:01 +02:00

watchdog.c

watchdog: move softlockup_panic back to early_param

2023-11-28 16:54:56 +00:00

workqueue_internal.h

…

workqueue.c

Revert "workqueue: remove unused cancel_work()"

2023-12-08 08:46:13 +01:00