vbpf / prevail / 22272173442

push

github

Reject null pointer with non-zero access size

When a helper accepts PTR_TO_MEM_OR_NULL paired with
CONST_SIZE_OR_ZERO, the ValidAccess checker verified that a null
pointer has svalue==0 but did not verify the corresponding access
width is also zero. This allowed passing NULL with an arbitrary
non-zero size to helpers like csum_diff.

The fix requires that when the pointer is null (T_NUM with or_null),
the access width must also be zero — matching the Linux kernel's
check_mem_access semantics.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Elazar Gershuni <elazarg@gmail.com>

3 of 5 new or added lines in 1 file covered. (60.0%)

13144 of 14847 relevant lines covered (88.53%)

4619186.78 hits per line