From: Amery Hung <ameryhung@gmail.com>
Date: Thu, 23 Jul 2026 22:18:14 +0000 (-0700)
Subject: bpf: Reject passing scalar NULL to nonnull arg of a global subprog
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=289e680c89ae8a0bb629fa8308313f5c8c6c76a3;p=thirdparty%2Fkernel%2Flinux.git

bpf: Reject passing scalar NULL to nonnull arg of a global subprog

A global subprogram argument tagged __arg_nonnull is set up as a
non-nullable PTR_TO_MEM. However the verifier does not check against a
scalar NULL, leading to real NULL pointer dereference. Reject it as
well.

Fixes: 94e1c70a3452 ("bpf: support 'arg:xxx' btf_decl_tag-based hints for global subprog args")
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20260723221815.367797-1-ameryhung@gmail.com
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
---

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 99444eae917e..7aa47342dc65 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9189,7 +9189,8 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
 				return ret;
 			if (check_mem_reg(env, reg, argno, arg->mem_size))
 				return -EINVAL;
-			if (!(arg->arg_type & PTR_MAYBE_NULL) && (reg->type & PTR_MAYBE_NULL)) {
+			if (!(arg->arg_type & PTR_MAYBE_NULL) &&
+			    (type_may_be_null(reg->type) || bpf_register_is_null(reg))) {
 				bpf_log(log, "%s is expected to be non-NULL\n",
 					reg_arg_name(env, argno));
 				return -EINVAL;