diff options
| author |   Daniel Borkmann <daniel@iogearbox.net> | 2026-04-09 17:50:15 +0200 |
|---|---|---|
| committer |   Alexei Starovoitov <ast@kernel.org> | 2026-04-09 13:11:31 -0700 |
| commit | 9f118095dd341885dbc3f1cd6a028414da099aba (patch) | |
| tree | 6afecdbc7c616ad74ac623771cb2421796b07a46 /samples/kobject/ssh:/git@git.zx2c4.com/git: | |
| parent | selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs (diff) | |
bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken
When a pkt pointer acquires AT_PKT_END or BEYOND_PKT_END range from
a comparison, and then, known-constant arithmetic is performed,
adjust_ptr_min_max_vals() copies the stale range via dst_reg->raw =
ptr_reg->raw without clearing the negative reg->range sentinel values.
This lets is_pkt_ptr_branch_taken() choose one branch direction and
skip going through the other. Fix this by clearing negative pkt range
values (that is, AT_PKT_END and BEYOND_PKT_END) after arithmetic on
pkt pointers. This ensures is_pkt_ptr_branch_taken() returns unknown
and both branches are properly verified.
Fixes: 6d94e741a8ff ("bpf: Support for pointers beyond pkt_end.")
Reported-by: STAR Labs SG <info@starlabs.sg>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260409155016.536608-1-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'samples/kobject/ssh:/git@git.zx2c4.com/git:')
0 files changed, 0 insertions, 0 deletions