Files
linux/kernel
Mykyta Yatsenko 4d0a375887 bpf: Fix NULL deref in map_kptr_match_type for scalar regs
Commit ab6c637ad0 ("bpf: Fix a bpf_kptr_xchg() issue with local
kptr") refactored map_kptr_match_type() to branch on btf_is_kernel()
before checking base_type(). A scalar register stored into a kptr
slot has no btf, so the btf_is_kernel(reg->btf) call dereferences
NULL.

Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf
access.

Fixes: ab6c637ad0 ("bpf: Fix a bpf_kptr_xchg() issue with local kptr")
Reported-by: Hiker Cl <clhiker365@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221372
Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
Acked-by: Paul Chaignon <paul.chaignon@gmail.com>
Link: https://lore.kernel.org/r/20260416-kptr_crash-v1-1-5589356584b4@meta.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-16 15:20:26 -07:00
..
2026-03-06 14:31:26 +01:00
2026-03-06 14:31:26 +01:00
2026-03-05 22:16:08 -05:00
2026-03-06 14:31:26 +01:00
2026-01-05 16:43:34 +01:00
2026-03-11 23:14:02 +01:00
2025-10-29 10:29:54 +01:00
2026-01-26 19:07:13 -08:00