mirror of
https://github.com/torvalds/linux.git
synced 2026-10-06 18:46:02 +02:00
2059d9af54
Add two paths whose packet pointer ranges are individually compatible at a join but whose members have different relative displacements. The first path proves an eight-byte access through one member. On the second path, the same guard only proves that the access starts before data_end. An affected verifier prunes the second path and accepts the program. With packet pointer class displacement preserved, it explores that path and rejects the out-of-bounds access. Read the unknown offset and branch selector directly from XDP context fields, and force state checkpoints so the pruning attempt does not depend on the verifier checkpoint heuristics. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://patch.msgid.link/20260917233222.2542500-4-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> |
||
|---|---|---|
| .. | ||
| crypto/chacha20-s390 | ||
| cxl | ||
| fault-injection | ||
| ktest | ||
| kunit | ||
| memblock | ||
| nvdimm | ||
| radix-tree | ||
| rbtree | ||
| scatterlist | ||
| selftests | ||
| shared | ||
| vma | ||
| vsock | ||