Merge branch 'bpf-fix-two-holes-in-the-analysis-of-stack-arguments'

Alexei Starovoitov says:

====================
bpf: Fix two holes in the analysis of stack arguments

From: Alexei Starovoitov <ast@kernel.org>

Before the main pass, arg_track follows pointers to the stack through
registers and spills. For each insn it tells which slots the insn can read,
which slots it can write, and which slot it writes for certain. Scalar
evolution and the removal of dead slots rely on the answer.

In two cases a store to other memory counts as a certain write to a stack
slot. Then scalar evolution misses a real write to the counter of a loop,
and a prog that accesses a map value out of bounds loads.

  patch 1   "r10, or not a pointer to the stack" counts as "exactly r10".
  patch 3   A call does not change what is known about the pointers that
            are spilled in the frame of the caller. But a static subprog or
            a callback can replace such a pointer with a pointer to a map
            value. Valid progs are rejected too.

Patches 2 and 4 are the tests. Patch 3 needs patch 1 for a spilled copy of
r10.

v1 -> v2:
- One series. v1 was two series [1] [2], and CI applied [2] without [1]
- Rebase on the bpf tree: patch 2 did not apply
- Test a callee that overwrites a spilled copy of r10: the case in which
  patch 3 needs patch 1 (CI bot)
- Change the two tests that match the log in patch 3, not in patch 4: they
  failed in between
- Load the test with a callback only when progs are JITed
- Make the tests shorter. None of them is in verifier_scev.c now
- Patch 1: the example in the log stores a pointer to a map value, as the
  test does. With 0 the prog does not load

[1] https://lore.kernel.org/bpf/20261031220615.804426-1-alexei.starovoitov@gmail.com/
[2] https://lore.kernel.org/bpf/20261101004657.3406576-1-alexei.starovoitov@gmail.com/

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
====================

Link: https://patch.msgid.link/20261102055913.3598414-1-alexei.starovoitov@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

0 files changed, 0 insertions, 0 deletions