Merge branch 'bpf-fix-null-deref-when-storing-scalar-into-kptr-slot'

Browse source

Mykyta Yatsenko says:

====================
bpf: Fix NULL deref when storing scalar into kptr slot

map_kptr_match_type() accesses reg->btf before confirming the register
is PTR_TO_BTF_ID. A scalar store into a kptr slot has no btf, causing
a NULL pointer dereference. Guard base_type() first.

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
====================

Link: https://patch.msgid.link/20260416-kptr_crash-v1-0-5589356584b4@meta.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

...

This commit is contained in:

Alexei Starovoitov 2026-04-16 15:20:27 -07:00

parent e5f635edd3 fcd11ff8bd

commit 766bf026d0

2 changed files with 19 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

kernel/bpf/verifier.c

View file

15

tools/testing/selftests/bpf/progs/map_kptr_fail.c

View file