Daniel Borkmann
30f27ca7ab
UPSTREAM: bpf: Fix ringbuf helper function compatibility
...
commit 5b029a32cfe4600f5e10e36b41778506b90fd4de upstream.
Commit 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support
for it") extended check_map_func_compatibility() by enforcing map -> helper
function match, but not helper -> map type match.
Due to this all of the bpf_ringbuf_*() helper functions could be used with
a wrong map type such as array or hash map, leading to invalid access due
to type confusion.
Also, both BPF_FUNC_ringbuf_{submit,discard} have ARG_PTR_TO_ALLOC_MEM as
argument and not a BPF map. Therefore, their check_map_func_compatibility()
presence is incorrect since it's only for map type checking.
Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it")
Reported-by: Ryota Shiga (Flatt Security)
Change-Id: I5b1693d2aaa1f028f66f485e82cb5a3292917294
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
2026-05-15 17:59:34 +07:00
..
bpf
UPSTREAM: bpf: Fix ringbuf helper function compatibility
2026-05-15 17:59:34 +07:00
cgroup
BACKPORT: bpf: Support replacing cgroup-bpf program in MULTI mode
2026-05-15 17:59:23 +07:00
configs
debug
UPSTREAM: kdb: use correct pointer when 'btc' calls 'btt'
2022-02-21 16:30:05 +01:00
events
BACKPORT: bpf: Convert bpf_prog refcnt to atomic64_t
2026-05-15 17:59:15 +07:00
gcov
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-20
2023-01-19 15:42:12 +01:00
irq
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
2022-07-18 14:05:31 +03:00
livepatch
BACKPORT: ftrace: Introduce PERMANENT ftrace_ops flag
2026-05-15 17:59:19 +07:00
locking
UPSTREAM: locking/lockdep: Add new check to lock_downgrade()
2026-05-15 17:57:11 +07:00
power
treewide: Backport new vmalloc for large performance benefits
2026-05-15 17:48:25 +07:00
printk
UPSTREAM: irq_work: Convert flags to atomic_t
2026-05-15 17:59:10 +07:00
rcu
rcu: Fix self-wakeups for grace-period kthread
2026-05-15 17:49:36 +07:00
sched
UPSTREAM: timers: Omit POSIX timer stuff from task_struct when disabled
2026-05-15 17:59:01 +07:00
time
BACKPORT: pid: Implement PIDTYPE_TGID
2026-05-15 17:59:02 +07:00
trace
BACKPORT: bpf: Allow specifying a BTF ID per argument in function protos
2026-05-15 17:59:31 +07:00
.gitignore
BACKPORT: Provide in-kernel headers to make extending kernel easier
2019-07-03 14:30:53 -04:00
acct.c
acct: fix potential integer overflow in encode_comp_t()
2023-01-07 12:07:31 +01:00
async.c
audit.c
BACKPORT: audit: use inline function to get audit context
2026-05-15 17:59:18 +07:00
audit.h
UPSTREAM: audit: log module name on init_module
2026-05-15 17:59:18 +07:00
audit_fsnotify.c
audit_tree.c
audit_watch.c
BACKPORT: audit: use inline function to get audit context
2026-05-15 17:59:18 +07:00
auditfilter.c
audit: fix a net reference leak in audit_list_rules_send()
2021-04-07 12:05:41 +02:00
auditsc.c
BACKPORT: audit: use inline function to get audit context
2026-05-15 17:59:18 +07:00
backtracetest.c
bounds.c
capability.c
cfi.c
compat.c
UPSTREAM: posix-timers: Make them configurable
2026-05-15 17:59:01 +07:00
configs.c
context_tracking.c
cpu.c
rcu: Migrate callbacks earlier in the CPU-offline timeline
2026-05-15 17:49:31 +07:00
cpu_pm.c
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into HEAD
2020-06-30 02:33:58 +03:00
crash_dump.c
cred.c
memcg: account security cred as well to kmemcg
2020-01-12 11:24:13 +01:00
delayacct.c
dma.c
exec_domain.c
exit.c
UPSTREAM: signal: Pass pid type into group_send_sig_info
2026-05-15 17:59:02 +07:00
extable.c
BACKPORT: bpf: Add support for BTF pointers to x86 JIT
2026-05-15 17:58:58 +07:00
fork.c
BACKPORT: pid: Implement PIDTYPE_TGID
2026-05-15 17:59:02 +07:00
freezer.c
futex.c
mm, futex: fix shared futex pgoff on shmem huge page
2021-07-11 12:46:40 +02:00
gen_kheaders.sh
BACKPORT: kheaders: Do not regenerate archive if config is not changed
2019-07-03 14:31:16 -04:00
groups.c
treewide: Backport new vmalloc for large performance benefits
2026-05-15 17:48:25 +07:00
hung_task.c
irq_work.c
UPSTREAM: irq_work: Convert flags to atomic_t
2026-05-15 17:59:10 +07:00
jump_label.c
jump_label: Disable jump labels in __exit code
2021-06-06 18:42:18 +03:00
kallsyms.c
BACKPORT: symbol lookup: introduce dereference_symbol_descriptor()
2026-05-15 17:57:02 +07:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
BACKPORT: bpf: introduce bpf_spin_lock
2026-05-15 17:57:29 +07:00
Kconfig.preempt
kcov.c
kexec.c
kexec_core.c
BACKPORT: mm: split page_type out from _mapcount
2026-05-15 17:57:58 +07:00
kexec_file.c
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
2022-07-18 14:05:31 +03:00
kexec_internal.h
kheaders.c
BACKPORT: kheaders: Move from proc to sysfs
2019-07-03 14:31:02 -04:00
kmod.c
BACKPORT: kmod: split out umh code into its own file
2026-05-15 17:56:31 +07:00
kprobes.c
UPSTREAM: kprobes: Show blacklist addresses as same as kallsyms does
2026-05-15 17:57:02 +07:00
ksysfs.c
kthread.c
Merge branch 'android-4.9-q' of https://android.googlesource.com/kernel/common into lineage-18.1-caf-sdm845
2021-07-22 02:11:11 +03:00
latencytop.c
Makefile
BACKPORT: kmod: split out umh code into its own file
2026-05-15 17:56:31 +07:00
membarrier.c
memremap.c
module-internal.h
module.c
UPSTREAM: audit: log module name on init_module
2026-05-15 17:59:18 +07:00
module_signing.c
notifier.c
x86/mm: split vmalloc_sync_all()
2020-04-02 17:20:26 +02:00
nsproxy.c
UPSTREAM: perf: Add PERF_RECORD_NAMESPACES to include namespaces related info
2026-05-15 17:58:54 +07:00
padata.c
padata: purge get_cpu and reorder_via_wq from padata_do_serial
2020-05-27 16:41:53 +02:00
panic.c
BACKPORT: locking/refcount: Create unchecked atomic_t implementation
2026-05-15 17:54:59 +07:00
params.c
pid.c
BACKPORT: pid: Implement PIDTYPE_TGID
2026-05-15 17:59:02 +07:00
pid_namespace.c
memcg: enable accounting for pids in nested pid namespaces
2021-09-22 11:43:08 +02:00
profile.c
profiling: fix shift-out-of-bounds bugs
2021-09-26 13:36:18 +02:00
ptrace.c
ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
2022-06-14 16:52:28 +02:00
range.c
reboot.c
reboot: fix overflow parsing reboot cpu number
2020-11-18 18:26:32 +01:00
relay.c
kernel/relay.c: fix memleak on destroy relay channel
2020-08-26 10:29:03 +02:00
resource.c
seccomp.c
UPSTREAM: seccomp, bpf: disable preemption before calling into bpf prog
2026-05-15 17:58:54 +07:00
signal.c
UPSTREAM: signal: Pass pid type into group_send_sig_info
2026-05-15 17:59:02 +07:00
smp.c
Merge remote-tracking branch 'common/android-4.9-q' into android12-4.9-sdm845
2022-06-12 01:39:01 +03:00
smpboot.c
smpboot.h
softirq.c
stacktrace.c
stop_machine.c
sys.c
syscall: Fake uname to 5.10.199 for bpfloader/netd
2026-05-15 17:59:26 +07:00
sys_ni.c
BACKPORT: signal: support CLONE_PIDFD with pidfd_send_signal
2019-09-03 13:44:59 -07:00
sysctl.c
BACKPORT: sysctl: define proc_do_static_key()
2026-05-15 17:57:55 +07:00
sysctl_binary.c
task_work.c
taskstats.c
taskstats: fix data-race
2020-01-12 11:24:12 +01:00
test_kprobes.c
torture.c
tracepoint.c
BACKPORT: tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
2026-05-15 17:57:41 +07:00
tsacct.c
taskstats: Cleanup the use of task->exit_code
2022-02-23 11:56:40 +01:00
ucount.c
uid16.c
umh.c
BACKPORT: umh: add exit routine for UMH process
2026-05-15 17:58:52 +07:00
up.c
user-return-notifier.c
user.c
user_namespace.c
utsname.c
utsname_sysctl.c
watchdog.c
watchdog_hld.c
workqueue.c
rcu: Create RCU-specific workqueues with rescuers
2026-05-15 17:49:31 +07:00
workqueue_internal.h