bpf: mark a NULL kfunc argument precisegrafted

check_kfunc_arg() allows bpf_register_is_null() for nullable arguments
w/o marking the underlying scalar register precise. Hence a checkpoint
created on such a path would prune against arbitrary scalar value.

Fixes: 3bda08b63670 ("bpf: Allow NULL buffers in bpf_dynptr_slice(_rw)")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-5-0f5a360ff15d@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

1 files changed, 17 insertions, 0 deletions

diff --git a/Documentation/security/lsm-development.rst b/Documentation/security/lsm-development.rst
new file mode 100644
index 000000000..5895e529d
--- /dev/null
+++ b/Documentation/security/lsm-development.rst
@@ -0,0 +1,17 @@
+=================================
+Linux Security Module Development
+=================================
+
+Based on https://lore.kernel.org/r/20071026073721.618b4778@laptopd505.fenrus.org,
+a new LSM is accepted into the kernel when its intent (a description of
+what it tries to protect against and in what cases one would expect to
+use it) has been appropriately documented in ``Documentation/admin-guide/LSM/``.
+This allows an LSM's code to be easily compared to its goals, and so
+that end users and distros can make a more informed decision about which
+LSMs suit their requirements.
+
+For extensive documentation on the available LSM hook interfaces, please
+see ``security/security.c`` and associated structures:
+
+.. kernel-doc:: security/security.c
+   :export: