Linux BPF Verifier: Fix NULL Argument Precision Marking Bug in check_func_args

Vulnerability Summary Overview Title: bpf: mark a NULL call argument precise Description: This patch addresses an imprecision marking issue in the BPF verifier when handling function call arguments. When allows a register to be treated as a nullable argument, if the underlying scalar register is NULL, the verifier incorrectly marks it as precise. This can lead to incorrect precision states during subsequent checks, potentially causing security issues. Fix Logic: In , when a register is detected as NULL, it is no longer directly marked as precise. The function is used to correctly mark the precision chain. For the argument, when the value is NULL, precision is marked as 2 rather than directly marking the register as precise. Impact Scope Component: Linux Kernel BPF Subsystem File: Test File: Author: Eduard Zingerman Reviewers: Alexei Starovoitov, Sasha Levin Remediation Core Modifications: 1. In the function, when the argument register is NULL: - Instead of directly setting and marking it as precise, - Call to correctly mark the precision. - Return an error if marking fails. 2. Special handling for : - When the value is NULL, call . - Return an error if marking fails. Test Cases: A new BPF verifier test case has been added to verify the precision marking behavior of NULL arguments in subprogram calls, ensuring the verifier correctly handles precision propagation. Code Changes Main Fix Code ( ) Test Case Code ( ) ```c // New test case snippet / r1, r4 are always precise for bpf_loop() r4 was marked before backtracking to callback body. */ { .frame = 0: propagating {r1,r4,r0} .frame = 6: propagating {r1,r4,r0} .frame = 6: propagating {r1,r4,r0} .last_idx = 9 first_idx = 9 subseq_idx = -1 .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before 18: {05} exit .stack before

Goal Reached Thanks to every supporter — we hit 100%!

Linux BPF Verifier: Fix NULL Argument Precision Marking Bug in check_func_args

More from this source