Yiyang Chen d8a6f79935 bpf: Propagate untrusted pointer state in commuted arithmetic ...

[ Upstream commit cdf19b1b3c ]

The untrusted PTR_TO_MEM early return skips pointer offset tracking
because accesses go through probe-read handling. Moving it after full
pointer-state propagation ensures scalar += untrusted_pointer leaves the
destination as PTR_TO_MEM instead of an unrelated scalar.

Fixes: f2362a57ae ("bpf: allow void* cast using bpf_rdonly_cast()")
Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Tested-by: Daniel Wade <danjwade95@gmail.com>
Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-3-8ee297e2346b@mails.tsinghua.edu.cn
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-08-19 18:17:21 +02:00

..

preload

…

arena.c

bpf: Validate node_id in arena_alloc_pages()

2026-05-23 13:06:52 +02:00

arraymap.c

bpf: Fix RCU stall in bpf_fd_array_map_clear()

2026-05-23 13:06:31 +02:00

bloom_filter.c

…

bpf_cgrp_storage.c

…

bpf_inode_storage.c

bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

2026-07-24 16:17:26 +02:00

bpf_iter.c

…

bpf_local_storage.c

…

bpf_lru_list.c

bpf: Fix NMI/tracepoint re-entry deadlock on lru locks

2026-07-24 16:16:02 +02:00

bpf_lru_list.h

bpf: Fix NMI/tracepoint re-entry deadlock on lru locks

2026-07-24 16:16:02 +02:00

bpf_lsm.c

bpf: Disable xfrm_decode_session hook attachment

2026-07-24 16:16:37 +02:00

bpf_struct_ops.c

…

bpf_task_storage.c

…

btf_iter.c

…

btf_relocate.c

…

btf.c

bpf: Validate BTF repeated field counts before expansion

2026-07-18 16:53:23 +02:00

cgroup_iter.c

…

cgroup.c

bpf: Fix effective prog array index with BPF_F_PREORDER

2026-07-24 16:16:35 +02:00

core.c

bpf: Tighten cgroup storage cookie checks for prog arrays

2026-07-24 16:16:08 +02:00

cpumap.c

bpf: Fix race in cpumap on PREEMPT_RT

2026-03-12 07:09:22 -04:00

cpumask.c

…

crypto.c

bpf: crypto: Use the correct destructor kfunc type

2026-03-04 07:19:40 -05:00

devmap.c

bpf: Run generic devmap egress prog on private skb

2026-07-24 16:16:11 +02:00

disasm.c

…

disasm.h

…

dispatcher.c

bpf: Restrict JIT predictor flush to cBPF

2026-07-18 16:53:26 +02:00

dmabuf_iter.c

bpf: Fix truncated dmabuf iterator reads

2026-01-02 12:56:37 +01:00

hashtab.c

bpf: Consistently use bpf_rcu_lock_held() everywhere

2026-07-24 16:17:23 +02:00

helpers.c

bpf: Consistently use bpf_rcu_lock_held() everywhere

2026-07-24 16:17:23 +02:00

inode.c

bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

2026-07-24 16:15:58 +02:00

Kconfig

…

kmem_cache_iter.c

…

link_iter.c

…

liveness.c

…

local_storage.c

bpf: fix end-of-list detection in cgroup_storage_get_next_key()

2026-05-23 13:06:30 +02:00

log.c

…

lpm_trie.c

bpf: Allow LPM map access from sleepable BPF programs

2026-07-24 16:17:23 +02:00

Makefile

…

map_in_map.c

bpf: Reject exclusive maps as inner maps in map-in-map

2026-07-24 16:15:58 +02:00

map_in_map.h

…

map_iter.c

bpf: Reject exclusive maps for bpf_map_elem iterators

2026-07-24 16:15:59 +02:00

memalloc.c

…

mmap_unlock_work.h

…

mprog.c

…

net_namespace.c

…

offload.c

…

percpu_freelist.c

…

percpu_freelist.h

…

prog_iter.c

…

queue_stack_maps.c

…

range_tree.c

…

range_tree.h

…

relo_core.c

…

reuseport_array.c

…

ringbuf.c

…

rqspinlock.c

rqspinlock: Fix TAS fallback lock entry creation

2026-02-26 14:59:04 -08:00

rqspinlock.h

…

stackmap.c

bpf: Fix stackmap overflow check in __bpf_get_stackid()

2025-12-18 14:02:42 +01:00

stream.c

…

syscall.c

bpf: Check tail zero of bpf_prog_info

2026-07-24 16:16:02 +02:00

sysfs_btf.c

…

task_iter.c

bpf: return VMA snapshot from task_vma iterator

2026-05-23 13:06:31 +02:00

tcx.c

…

tnum.c

bpf: Introduce tnum_step to step through tnum's members

2026-03-12 07:09:23 -04:00

token.c

…

trampoline.c

bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

2026-03-12 07:09:55 -04:00

verifier.c

bpf: Propagate untrusted pointer state in commuted arithmetic

2026-08-19 18:17:21 +02:00