Re: [PATCH bpf v3 1/2] bpf: Validate stack arg reads against caller state

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Sun, 25 Oct 2026 18:52:49 -0700 you wrote:
> check_stack_arg_read() bounds a stack argument index with the callee's
> BTF-derived argument count, then uses the index in the caller's
> stack_arg_regs[] array. The array's actual logical length is recorded in
> caller->out_stack_arg_cnt, so the bound and indexed object can diverge.
> 
> A crafted BPF_PROG_LOAD can use an argument mismatch to mark a static
> subprogram's BTF information unreliable. Later calls return from
> btf_check_subprog_call() before check_outgoing_stack_args(), while
> check_func_call() continues the static call on -EINVAL. The callee can
> then read a slot that the caller never allocated or initialized. The
> earlier commit 4286f5deee14 ("bpf: Validate outgoing stack args when
> btf_prepare_func_args fails") closed this hole for the first call, but
> not for later calls after the subprogram has been marked unreliable.
> 
> [...]

Here is the summary with links:
  - [bpf,v3,1/2] bpf: Validate stack arg reads against caller state
    https://git.kernel.org/bpf/bpf/c/90aedf8854c0
  - [bpf,v3,2/2] selftests/bpf: Test missing and callback stack arguments
    https://git.kernel.org/bpf/bpf/c/195a3519ff27

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html