Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

ae453eef · Linus Torvalds <[email protected]> · 2026-07-24 19:31:12 -07:00

Pull bpf fixes from Eduard Zingerman:

 - Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed
   sk_psock->cork for the local temporary message and freeing it again
   (Chengfeng Ye)

 - Reject passing scalar NULL to nonnull arg of a global subprog.

   Previously the verifier did not account for the cases directly
   passing scalars to a global subprog, e.g.: 'global_func(0);' would
   pass even if 'global_func' argument was marked nonnull (Amery Hung)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
  selftests/bpf: Test passing scalar NULL to nonnull global subprog
  bpf: Reject passing scalar NULL to nonnull arg of a global subprog

Commit: ae453eef925945a02bb558bff9debbee352e33e9
Parents: e2a93699 · 2d66a033

Merge commit. Changes below are compared with the first parent: e2a93699.

Changes

3 files changed · +13 −2

File	Status	Add	Del	Content
kernel/bpf/verifier.c	modified	+2	−1	View file
net/ipv4/tcp_bpf.c	modified	+1	−1	View file
tools/testing/selftests/bpf/progs/verifier_global_subprogs.c	modified	+10	−0	View file

kernel/bpf/verifier.c

View file

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 99444ea..7aa4734 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9189,7 +9189,8 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
 				return ret;
 			if (check_mem_reg(env, reg, argno, arg->mem_size))
 				return -EINVAL;
-			if (!(arg->arg_type & PTR_MAYBE_NULL) && (reg->type & PTR_MAYBE_NULL)) {
+			if (!(arg->arg_type & PTR_MAYBE_NULL) &&
+			    (type_may_be_null(reg->type) || bpf_register_is_null(reg))) {
 				bpf_log(log, "%s is expected to be non-NULL\n",
 					reg_arg_name(env, argno));
 				return -EINVAL;

net/ipv4/tcp_bpf.c

View file

diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index 8e905b5..a30475a 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -604,7 +604,7 @@ wait_for_sndbuf:
 wait_for_memory:
 		err = sk_stream_wait_memory(sk, &timeo);
 		if (err) {
-			if (msg_tx && msg_tx != psock->cork)
+			if (msg_tx == &tmp)
 				sk_msg_free(sk, msg_tx);
 			goto out_err;
 		}

tools/testing/selftests/bpf/progs/verifier_global_subprogs.c

View file

diff --git a/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c b/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
index 75a2e3f..67dc352 100644
--- a/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
+++ b/tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
@@ -185,6 +185,16 @@ int arg_tag_nonnull_ptr_good(void *ctx)
 	return subprog_nonnull_ptr_good(&x, &y);
 }
 
+SEC("?raw_tp")
+__failure __log_level(2)
+__msg("R1 is expected to be non-NULL")
+int arg_tag_nonnull_ptr_null_bad(void *ctx)
+{
+	int y = 74;
+
+	return subprog_nonnull_ptr_good(NULL, &y);
+}
+
 /* this global subprog can be now called from many types of entry progs, each
  * with different context type
  */