]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
bpf: Compare parent_id in refsafe() for REF_TYPE_PTR
authorAmery Hung <ameryhung@gmail.com>
Fri, 5 Jun 2026 20:20:54 +0000 (13:20 -0700)
committerAlexei Starovoitov <ast@kernel.org>
Fri, 5 Jun 2026 21:18:20 +0000 (14:18 -0700)
commit41025f441fe6addd93d2c333a3a184331e8ef6cf
treef651af298fccf3cf7975d28ee8ecc3b76438e8b3
parent73d475dc6c13177fce0d9d892bff33299c8ad56a
bpf: Compare parent_id in refsafe() for REF_TYPE_PTR

refsafe() compared each reference's id and type but not its parent_id,
so two states whose PTR references differ only in the parent object they
were derived from could be wrongly treated as equivalent and pruned. Fix
it by checking parent_id too.

Fixes: 308c7a0ae885 ("bpf: Refactor object relationship tracking and fix dynptr UAF bug")
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20260605202056.1780352-4-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/states.c