Merge branch 'bpf-fix-the-stack-buffer-that-bpf_dynptr_slice_rdwr-returns'

Alexei Starovoitov says:

====================
bpf: Fix the stack buffer that bpf_dynptr_slice_rdwr() returns

From: Alexei Starovoitov <ast@kernel.org>

bpf_dynptr_slice_rdwr() and bpf_dynptr_slice() can return the buffer. When
the buffer is on the stack, the prog has two pointers to the same stack
slot, and the verifier knows only one of them. A store through the slice
changes data that the verifier tracks in the slot: a known scalar, a
spilled pointer, a dynptr, an iterator. Such a prog loads today and can
crash the kernel. A load through the slice reads such data as a scalar.

Patch 1 invalidates the slice when the prog stores to the buffer, or when
the frame of the buffer returns. Patch 2 has the tests.

The selftests that pass a stack buffer to the kfuncs only read the buffer
after the call. They load as before, with the same number of processed
insns. Cilium and sched-ext/scx do not use the kfuncs. test_progs and
test_verifier have no new failure.

v1 -> v2:
 - Read-only slices of bpf_dynptr_slice() follow the same rule (Sashiko).
 - Tests for read-only slices, one of them with a file dynptr. The progs
   end with a load through the slice.
 - Shorter tests: a macro for the callees, less in the run-time test.

v1: https://lore.kernel.org/bpf/20261102055543.3584718-1-alexei.starovoitov@gmail.com/

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
====================

Link: https://patch.msgid.link/20261102170958.3586893-1-alexei.starovoitov@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

0 files changed, 0 insertions, 0 deletions