bpf: Reject passing scalar NULL to nonnull arg of a global subprog
authorAmery Hung <ameryhung@gmail.com>
Thu, 23 Jul 2026 22:18:14 +0000 (15:18 -0700)
committerEduard Zingerman <eddyz87@gmail.com>
Thu, 23 Jul 2026 23:09:07 +0000 (16:09 -0700)
commit289e680c89ae8a0bb629fa8308313f5c8c6c76a3
treefec61c0877579c40642732193780ef8b9556ca97
parent94515f3a7d4256a5062176b7d6ed0471938cd51a
bpf: Reject passing scalar NULL to nonnull arg of a global subprog

A global subprogram argument tagged __arg_nonnull is set up as a
non-nullable PTR_TO_MEM. However the verifier does not check against a
scalar NULL, leading to real NULL pointer dereference. Reject it as
well.

Fixes: 94e1c70a3452 ("bpf: support 'arg:xxx' btf_decl_tag-based hints for global subprog args")
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260723221815.367797-1-ameryhung@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
kernel/bpf/verifier.c