- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS v3] netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
by superdcc97＠163.com 12 Oct '26

12 Oct '26

From: Jozsef Kadlecsik <kadlec(a)netfilter.org> mainline inclusion from mainline-v7.2-rc1 commit e4b4984e28c16406ecb318444dea4a8bf47def3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17399 CVE: CVE-2026-72436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types") Signed-off-by: Jozsef Kadlecsik <kadlec(a)netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/ipset/ip_set_hash_gen.h [context differences from mainline: f66ee0410b1c: resize still holds set->lock; mtype_ext_size() is absent. 7f7445840b77: bucket position accesses are not annotated. 8238b4579866: test_bit_acquire() is absent; use its generic acquire-load and bit-mask semantics at the lockless readers. Add comment for memory barrier to fix checkpatch warning] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_hash_gen.h | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 154b40f2f2a8..305e900b5882 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -588,7 +588,9 @@ mtype_resize(struct ip_set *set, bool retried) if (!n) continue; for (j = 0; j < n->pos; j++) { - if (!test_bit(j, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(j)]) & + BIT_MASK(j))) continue; data = ahash_data(n, j, dsize); #ifdef IP_SET_HASH_WITH_NETS @@ -947,7 +949,9 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1002,7 +1006,9 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext, goto out; } for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1128,7 +1134,9 @@ mtype_list(const struct ip_set *set, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; e = ahash_data(n, i, set->dsize); if (SET_WITH_TIMEOUT(set) && -- 2.43.0

2 1

[PATCH OLK-6.6] bpf: reject BPF_PSEUDO_FUNC reference to the main program
by Pu Lehui 12 Oct '26

12 Oct '26

From: Eduard Zingerman <eddyz87(a)gmail.com> stable inclusion from stable-v6.6.158 commit 8cb75f7ada25b1cf25f2f74dec3ba649b9064a09 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19759 CVE: CVE-2026-98075 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 374b2c5561db80fcdd7cdce44af37a49416f61c7 ] fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real function addresses. This function is invoked from bpf_jit_subprogs() only when env->subprog_cnt > 1. Meaning that for any program like below: int main(void *ctx) { void *ptr = main; ... bpf_timer_set_callback(..., ptr); ... } The 'ptr' won't be ever converted to contain an address. In combination with e.g. bpf_timer_set_callback() this would lead to a function call at a bogus address. Instead of complicating the implementation, just assume that no useful program needs main to be a sync or async callback and reject BPF_PSEUDO_FUNC loads for the main subprogram. Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper") Reported-by: Nicholas Carlini <npc(a)anthropic.com> Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20260902233658.1186477-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index c9921971950d..b796d985e420 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -15286,6 +15286,15 @@ static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn) verbose(env, "callback function not static\n"); return -EINVAL; } + /* + * When env->subprog_cnt == 1 this instruction won't be rewritten + * to hold a real function address. Assume that no usable program + * combines e.g. main and timer callback and just reject here. + */ + if (subprogno == 0) { + verbose(env, "callback function cannot be the main program\n"); + return -EINVAL; + } dst_reg->type = PTR_TO_FUNC; dst_reg->subprogno = subprogno; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v2] netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
by superdcc97＠163.com 12 Oct '26

12 Oct '26

From: Jozsef Kadlecsik <kadlec(a)netfilter.org> mainline inclusion from mainline-v7.2-rc1 commit e4b4984e28c16406ecb318444dea4a8bf47def3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17399 CVE: CVE-2026-72436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types") Signed-off-by: Jozsef Kadlecsik <kadlec(a)netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/ipset/ip_set_hash_gen.h [context differences from mainline: f66ee0410b1c: resize still holds set->lock; mtype_ext_size() is absent. 7f7445840b77: bucket position accesses are not annotated. 8238b4579866: test_bit_acquire() is absent; use its generic acquire-load and bit-mask semantics at the three lockless readers. Add comment for memory barrier to fix checkpatch warning] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_hash_gen.h | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 154b40f2f2a8..10c6af0f4984 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -588,7 +588,9 @@ mtype_resize(struct ip_set *set, bool retried) if (!n) continue; for (j = 0; j < n->pos; j++) { - if (!test_bit(j, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, j, dsize); #ifdef IP_SET_HASH_WITH_NETS @@ -947,7 +949,9 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1002,7 +1006,9 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext, goto out; } for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1128,7 +1134,9 @@ mtype_list(const struct ip_set *set, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; e = ahash_data(n, i, set->dsize); if (SET_WITH_TIMEOUT(set) && -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
by superdcc97＠163.com 12 Oct '26

12 Oct '26

From: Jozsef Kadlecsik <kadlec(a)netfilter.org> mainline inclusion from mainline-v7.2-rc1 commit e4b4984e28c16406ecb318444dea4a8bf47def3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17399 CVE: CVE-2026-72436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types") Signed-off-by: Jozsef Kadlecsik <kadlec(a)netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/ipset/ip_set_hash_gen.h [context differences from mainline: f66ee0410b1c: resize still holds set->lock; mtype_ext_size() is absent. 7f7445840b77: bucket position accesses are not annotated. 8238b4579866: test_bit_acquire() is absent; use its generic acquire-load and bit-mask semantics at the three lockless readers.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_hash_gen.h | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 154b40f2f2a8..1cb7e5c1fc61 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -947,7 +947,9 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1002,7 +1004,9 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext, goto out; } for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1128,7 +1132,9 @@ mtype_list(const struct ip_set *set, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; e = ahash_data(n, i, set->dsize); if (SET_WITH_TIMEOUT(set) && -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc
by Zhou Minqiang 12 Oct '26

12 Oct '26

Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc Zhou Minqiang (2): md/raid1: change r1conf->r1bio_pool to a pointer type md/raid1: remove struct pool_info and related code drivers/md/raid1.c | 84 +++++++++++++++++----------------------------- drivers/md/raid1.h | 22 +----------- 2 files changed, 31 insertions(+), 75 deletions(-) -- 2.52.0

2 4

[PATCH OLK-6.6] procfs: move dropping pde and pid from ->evict_inode() to ->free_inode()
by Zhou Minqiang 12 Oct '26

12 Oct '26

mainline inclusion from mainline-v6.8-rc6 commit 47458802f6606f652cd0f6dc38cd52ce60ec0145 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- that keeps both around until struct inode is freed, making access to them safe from rcu-pathwalk Acked-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/proc/base.c | 2 -- fs/proc/inode.c | 19 ++++++++----------- 2 files changed, 8 insertions(+), 13 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 7ee2285910bb..f34e357e9f97 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1932,8 +1932,6 @@ void proc_pid_evict_inode(struct proc_inode *ei) hlist_del_init_rcu(&ei->sibling_inodes); spin_unlock(&pid->lock); } - - put_pid(pid); } struct inode *proc_pid_make_inode(struct super_block *sb, diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 92772702d369..85a09918507e 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -30,7 +30,6 @@ static void proc_evict_inode(struct inode *inode) { - struct proc_dir_entry *de; struct ctl_table_header *head; struct proc_inode *ei = PROC_I(inode); @@ -38,17 +37,8 @@ static void proc_evict_inode(struct inode *inode) clear_inode(inode); /* Stop tracking associated processes */ - if (ei->pid) { + if (ei->pid) proc_pid_evict_inode(ei); - ei->pid = NULL; - } - - /* Let go of any associated proc directory entry */ - de = ei->pde; - if (de) { - pde_put(de); - ei->pde = NULL; - } head = ei->sysctl; if (head) { @@ -80,6 +70,13 @@ static struct inode *proc_alloc_inode(struct super_block *sb) static void proc_free_inode(struct inode *inode) { + struct proc_inode *ei = PROC_I(inode); + + if (ei->pid) + put_pid(ei->pid); + /* Let go of any associated proc directory entry */ + if (ei->pde) + pde_put(ei->pde); kmem_cache_free(proc_inode_cachep, PROC_I(inode)); } -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc
by Zhou Minqiang 12 Oct '26

12 Oct '26

Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc Zhou Minqiang (2): md/raid1: change r1conf->r1bio_pool to a pointer type md/raid1: remove struct pool_info and related code drivers/md/raid1.c | 86 +++++++++++++++++----------------------------- drivers/md/raid1.h | 22 +----------- 2 files changed, 32 insertions(+), 76 deletions(-) -- 2.52.0

2 3

[PATCH OLK-5.10] procfs: move dropping pde and pid from ->evict_inode() to ->free_inode()
by Zhou Minqiang 12 Oct '26

12 Oct '26

mainline inclusion from mainline-v6.8-rc6 commit 47458802f6606f652cd0f6dc38cd52ce60ec0145 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- that keeps both around until struct inode is freed, making access to them safe from rcu-pathwalk Acked-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/proc/base.c | 2 -- fs/proc/inode.c | 19 ++++++++----------- 2 files changed, 8 insertions(+), 13 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 845897ca7e54..7fa69a84899d 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2082,8 +2082,6 @@ void proc_pid_evict_inode(struct proc_inode *ei) hlist_del_init_rcu(&ei->sibling_inodes); spin_unlock(&pid->lock); } - - put_pid(pid); } struct inode *proc_pid_make_inode(struct super_block *sb, diff --git a/fs/proc/inode.c b/fs/proc/inode.c index ba35ffc426ea..df934ded1bf2 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -32,7 +32,6 @@ static void proc_evict_inode(struct inode *inode) { - struct proc_dir_entry *de; struct ctl_table_header *head; struct proc_inode *ei = PROC_I(inode); @@ -40,17 +39,8 @@ static void proc_evict_inode(struct inode *inode) clear_inode(inode); /* Stop tracking associated processes */ - if (ei->pid) { + if (ei->pid) proc_pid_evict_inode(ei); - ei->pid = NULL; - } - - /* Let go of any associated proc directory entry */ - de = ei->pde; - if (de) { - pde_put(de); - ei->pde = NULL; - } head = ei->sysctl; if (head) { @@ -82,6 +72,13 @@ static struct inode *proc_alloc_inode(struct super_block *sb) static void proc_free_inode(struct inode *inode) { + struct proc_inode *ei = PROC_I(inode); + + if (ei->pid) + put_pid(ei->pid); + /* Let go of any associated proc directory entry */ + if (ei->pde) + pde_put(ei->pde); kmem_cache_free(proc_inode_cachep, PROC_I(inode)); } -- 2.52.0

2 1

[PATCH OLK-5.10] bpf: Don't predict JMP32 pointer vs zero comparisons
by Chen Yuxi 12 Oct '26

12 Oct '26

From: Eduard Zingerman <eddyz87(a)gmail.com> mainline inclusion from mainline-v7.3-rc2 commit e51179a4e09846f8fd0f26a05068520de2b301bf category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19773 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Consider the following program: r1 = map_value; /* low 32 bits are zero at runtime */ r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = *(u64 *)(r1 + 0); exit; l1: r6 = 0; goto l0; At the moment is_branch_taken() reports the jump as always taken, because it does not distinguish between BPF_JMP and BPF_JMP32 comparisons when processing 'if w1 != 0 ...'. Fixes: cac616db39c2 ("bpf: Verifier track null pointer branch_taken with JNE and JEQ") Reported-by: Nicholas Carlini <npc(a)anthropic.com> Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/bpf/20260904083325.2083493-5-eddyz87@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Conflicts: kernel/bpf/verifier.c [commit b254c6d816e53ca02856b6f46b4dc56caf6e7713 not backport] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/bpf/verifier.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index d75b3aa76dfc..80fe5730da51 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -7909,6 +7909,13 @@ static int is_branch_taken(struct bpf_reg_state *reg, u64 val, u8 opcode, bool is_jmp32) { if (__is_pointer_value(false, reg)) { + /* + * The low 32 bits of a valid pointer may well be zero, hence + * nothing below applies to a 32-bit comparison. + */ + if (is_jmp32) + return -1; + if (!reg_type_not_null(reg->type)) return -1; -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: mark a NULL call argument precise
by Chen Yuxi 12 Oct '26

12 Oct '26

From: Eduard Zingerman <eddyz87(a)gmail.com> mainline inclusion from mainline-v7.3-rc2 commit 1a3a10b030c96ea88868ccc060a16827c01eaa5a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19832 CVE: CVE-2026-98019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag. Fixes: b5dc0163d8fd ("bpf: precise scalar_value tracking") Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-1-0f5a… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c, tools/testing/selftests/bpf/progs/verifier_subprog_precision.c [verifier_subprog_precision.c does not exist in 5.10.] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/bpf/verifier.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index d75b3aa76dfc..3af71ac0da16 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -4926,11 +4926,15 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, return err; } - if (register_is_null(reg) && type_may_be_null(arg_type)) + if (register_is_null(reg) && type_may_be_null(arg_type)) { /* A NULL register has a SCALAR_VALUE type, so skip * type checking. */ + err = mark_chain_precision(env, regno); + if (err) + return err; goto skip_type_check; + } /* arg_btf_id and arg_size are in a union. */ if (base_type(arg_type) == ARG_PTR_TO_BTF_ID) @@ -5891,10 +5895,14 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn /* check that flags argument in get_local_storage(map, flags) is 0, * this is required because get_local_storage() can't return an error. */ - if (func_id == BPF_FUNC_get_local_storage && - !register_is_null(&regs[BPF_REG_2])) { - verbose(env, "get_local_storage() doesn't support non-zero flags\n"); - return -EINVAL; + if (func_id == BPF_FUNC_get_local_storage) { + if (!register_is_null(&regs[BPF_REG_2])) { + verbose(env, "get_local_storage() doesn't support non-zero flags\n"); + return -EINVAL; + } + err = mark_chain_precision(env, BPF_REG_2); + if (err) + return err; } /* reset caller saved regs */ -- 2.34.1

2 1