Yiyang Chen 8cb23101a3 bpf: Preserve pointer state for commuted arithmetic ...

[ Upstream commit a4c6f804b4 ]

When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
destination register inherits the pointer state from the source pointer.
Copying only selected fields is fragile because pointer provenance is
tracked by several bpf_reg_state fields.

Use the caller's temporary offset register to preserve the scalar operand
while replacing the destination with the full pointer state. This preserves
the frame number for PTR_TO_STACK registers and keeps parent identity
fields consistent.

Fixes: f4d7e40a5b ("bpf: introduce function calls (verification)")
Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Tested-by: Daniel Wade <danjwade95@gmail.com>
Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-2-8ee297e2346b@mails.tsinghua.edu.cn
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-08-19 18:13:05 +02:00

..

preload

bpf/preload: Don't select USERMODE_DRIVER

2025-08-15 12:08:51 +02:00

arraymap.c

bpf: Fix RCU stall in bpf_fd_array_map_clear()

2026-05-23 13:03:08 +02:00

bloom_filter.c

…

bpf_cgrp_storage.c

bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage

2025-05-02 07:50:53 +02:00

bpf_inode_storage.c

bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

2026-08-03 11:15:33 +02:00

bpf_iter.c

…

bpf_local_storage.c

bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT

2025-02-08 09:52:06 +01:00

bpf_lru_list.c

bpf: Adjust free target to avoid global starvation of LRU map

2025-07-17 18:35:21 +02:00

bpf_lru_list.h

bpf: Adjust free target to avoid global starvation of LRU map

2025-07-17 18:35:21 +02:00

bpf_lsm.c

bpf: drop bpf_lsm_getselfattr from hook list

2026-08-03 11:15:33 +02:00

bpf_struct_ops_types.h

…

bpf_struct_ops.c

…

bpf_task_storage.c

…

btf.c

bpf: Release module BTF IDR before module unload

2026-04-02 13:07:13 +02:00

cgroup_iter.c

…

cgroup.c

bpf: Fix effective prog array index with BPF_F_PREORDER

2026-07-24 16:03:21 +02:00

core.c

bpf: Tighten cgroup storage cookie checks for prog arrays

2026-07-24 16:03:10 +02:00

cpumap.c

…

cpumask.c

…

devmap.c

bpf: Run generic devmap egress prog on private skb

2026-07-24 16:03:12 +02:00

disasm.c

…

disasm.h

…

dispatcher.c

bpf: Restrict JIT predictor flush to cBPF

2026-07-24 16:02:57 +02:00

hashtab.c

bpf: Consistently use bpf_rcu_lock_held() everywhere

2026-07-24 16:03:50 +02:00

helpers.c

bpf: Consistently use bpf_rcu_lock_held() everywhere

2026-07-24 16:03:50 +02:00

inode.c

bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs

2026-07-24 16:03:05 +02:00

Kconfig

…

link_iter.c

…

local_storage.c

bpf: fix end-of-list detection in cgroup_storage_get_next_key()

2026-05-23 13:03:07 +02:00

log.c

…

lpm_trie.c

bpf: Allow LPM map access from sleepable BPF programs

2026-07-24 16:03:50 +02:00

Makefile

…

map_in_map.c

…

map_in_map.h

…

map_iter.c

…

memalloc.c

…

mmap_unlock_work.h

…

mprog.c

…

net_namespace.c

…

offload.c

…

percpu_freelist.c

…

percpu_freelist.h

…

prog_iter.c

…

queue_stack_maps.c

…

reuseport_array.c

…

ringbuf.c

bpf: Sync pending IRQ work before freeing ring buffer

2025-11-24 10:29:13 +01:00

stackmap.c

…

syscall.c

bpf: Check tail zero of bpf_prog_info

2026-07-24 16:03:07 +02:00

sysfs_btf.c

…

task_iter.c

bpf: Fix iter/task tid filtering

2024-11-01 01:58:25 +01:00

tcx.c

…

tnum.c

…

trampoline.c

bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

2026-03-25 11:05:41 +01:00

verifier.c

bpf: Preserve pointer state for commuted arithmetic

2026-08-19 18:13:05 +02:00