BPF verifier fixed to stop false non-NULL pointer inference

The Linux BPF verifier has landed a set of fixes that close holes where it wrongly treated pointers as known non-NULL, allowing programs that look safe under verification to dereference null at runtime.

Eduard Zingerman wrote the patches after reports from Nicholas Carlini. The core mistake was treating a pointer type alone as proof of a non-null value. For types that permit arithmetic, only the base is guaranteed non-null; an unbounded offset can still wrap the effective address to zero. Equality checks against such a pointer then let the verifier clear the maybe-null flag on a real null map lookup result, and a later load faults.

Related gaps went the same way. Thirty-two-bit compares against zero were treated like full-width null checks even though the low half of a valid pointer can be zero, so one branch was skipped and never verified. Register-form null checks against a scalar that happens to be zero on one path failed to mark that scalar precise, so state pruning could drop the unsafe path where the scalar is non-zero and the load still runs. Linked-register bookkeeping could also resurrect scalar identities the verifier had already dropped, leaving precision tracking incomplete.

Together the bugs meant crafted eBPF could slip past the verifier and touch null map values. The series tightens when non-null may be inferred, refuses to predict 32-bit pointer-versus-zero jumps, requires precision on register-form zero checks, and adjusts linked-register collection order. Kumar Kartikeya Dwivedi applied the work to the bpf tree. Matching selftests now reject the previously accepted cases.