Merge branch 'bpf-reject-non-negative-stack-object-offsets'

Xu Yunxiang says:

====================
bpf: Reject non-negative stack object offsets

Reject non-negative offsets before converting a stack object address to a
stack slot index. Add a regression test for iterator destruction through
fp+0.

Changes in v2:
- Split the kernel change and selftest as requested by Andrii.
- Rebase onto bpf/master at a11212910cf09b2fe8db9afa41ef60c4f81879c5.
- Keep the original code and test changes unchanged and retain Sun Jian's
  Reviewed-by on both parts.

v1: https://lore.kernel.org/bpf/20260911084314.3481637-1-xyx2021@mail.ustc.edu.cn/
Split request: https://lore.kernel.org/bpf/CAEf4BzbYzt-Riekpc-A=MfQft9ZELwSDSE8kkQO1ZOyR3O_FAg@mail.gmail.com/

Validation on this exact candidate with a matching bpf_testmod:
  - W=1 verifier, full kernel/modules, changed BPF objects and test_progs
    builds passed.
  - iters: 1/97 passed; 0 skipped.
  - dynptr: 2/132 passed; 0 skipped.
  - irq: 1/33 passed; 0 skipped.
  - res_spin_lock: 3/14 passed; 1 skipped.
  - file_reader: 1/8 passed; 0 skipped.
  - kmem_cache_iter: 1/3 passed; 0 skipped.
  - dmabuf_iter: 1/4 passed; 0 skipped.

No selected test failed. The VM ran with panic_on_warn and panic_on_oops;
no kernel WARN, Oops or panic was found.

res_spin_lock_stress skips because the VM has no hardware PMU.

Annotated verifier tests check load outcomes and diagnostics. The full
unfiltered suite, sanitizer configurations and architecture matrix were
not run.

Please queue this fix for stable after it reaches the BPF tree.
====================

Link: https://patch.msgid.link/20260920210423.345636-1-xyx2021@mail.ustc.edu.cn
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

0 files changed, 0 insertions, 0 deletions