Merge branch 'bpf-fix-stack-argument-precision-propagation'

Xu Yunxiang says:

====================
bpf: Fix stack argument precision propagation

Outgoing stack arguments retain scalar state separately from registers
and ordinary spills. Their precision dependencies must reach ancestor
states when verification reuses a state or falls back to marking all
scalars precise. Otherwise, an out-of-bounds map access can reuse a state
validated for an in-bounds argument.

Patch 1 covers outgoing scalar argument slots in both precision paths.
Patch 2 adds two load-only asm regressions in verifier_stack_arg.c, based
on Alexei's examples.

Changes in v2:
- Keep the patch 1 fix and explanation unchanged; rebase onto bpf/master
  at 03b013897454064e0a2d84a8ba9a24753eb02f2b.
- Replace the standalone instruction/BTF test builder with two asm tests
  in the existing verifier_stack_arg.c, as requested by Alexei.
- Reuse that file's compiler capability and architecture guards, which
  already cover x86-64, arm64 and RV64. Drop the separate host-side guard.
- Rewrite patch 2's explanation for the two replacement tests.

v1:
https://lore.kernel.org/bpf/20261027061303.1754535-1-xyx2021@mail.ustc.edu.cn/
Review:
https://lore.kernel.org/bpf/DMJI3GWXQOC9.UA3K9X139AR@gmail.com/

Validation on x86-64 with Clang 23.1.4, JIT enabled and panic_on_warn=1:
- Built all four kernel variants and their BPF test modules, plus the
  complete test_progs runner with BPF_STRICT_BUILD=1.
- The two new tests distinguish the two precision paths:

                         State reuse       Fallback
  Unmodified baseline    wrongly accepts   wrongly accepts
  Propagation fix only   rejects           wrongly accepts
  Fallback fix only      wrongly accepts   rejects
  Complete fix           rejects           rejects

  Rejections report the intended map-value bounds violation. The two
  corresponding in-bounds controls load successfully on all four kernels.
  These programs are never attached or executed.
- All 274 subtests passed, with no skips, across verifier_precision,
  verifier_spill_fill, verifier_subprog_precision, verifier_scalar_ids,
  stack_arg_precision, verifier_stack_arg, verifier_stack_arg_order and
  iters on the complete candidate. No kernel WARN/Oops or panic occurred.
- Compiled the test object under x86-64, arm64 and RV64 guard definitions;
  Clang 20 correctly selects the existing unsupported-compiler dummy.
  Runtime testing was x86-64 only, and the unfiltered suite was not run.

Codex assisted with implementation, test integration, commit messages
and validation. The v2 test code was supplied by Alexei and is used
unchanged.
====================

Link: https://patch.msgid.link/20261102190350.788433-1-xyx2021@mail.ustc.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

0 files changed, 0 insertions, 0 deletions