1
90%
main: 90%

Ran 21 Feb 2026 06:37PM UTC

Files 81

Run time 2s

Badge

Embed ▾

Committed 21 Feb 2026 06:02PM UTC coverage: 85.948% (+0.004%) from 85.944%

Job # 22261606104.1

Build Type

push

github

Committed by

web-flow

Commit Message

Fix two verifier soundness bugs found by pentest (#1028)

* Fix two verifier soundness bugs found by pentest

1. Stale shared_region_size after map_lookup fallthrough: when the map
   type/fd is ambiguous, the fallthrough path set T_SHARED without
   havocing shared_region_size, letting a stale value from a prior
   lookup persist. This allowed OOB reads on map values. Fix:
   Extract assign_shared_map_value to deduplicate the 4-line shared
   pointer setup (assign_valid_ptr, shared_offset, shared_region_size,
   assign_type). Flatten the nested if-pyramid in resolve_map_lookup
   into early returns. 

2. Stale r1-r5 after BPF-to-BPF call return: the Exit handler for
   subprogram returns restored callee-saved registers (r6-r9) and r10
   but never scratched caller-saved registers (r1-r5). A caller could
   then use stale pointer values in r1-r5 that the callee may have
   invalidated. Fix: call scratch_caller_saved_registers() in Exit.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Elazar Gershuni <elazarg@gmail.com>

---------

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Coverage Stats

11248 of 13087 relevant lines covered (85.95%)

1696120.15 hits per line

vbpf / prevail / 22261606104 / 1
90%
main: 90%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job run-Debug - 22261606104.1

vbpf / prevail / 22261606104 / 1 90% main: 90%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job run-Debug - 22261606104.1

vbpf / prevail / 22261606104 / 1
90%
main: 90%

README BADGES
x