Re: [PATCH bpf v2 1/2] bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops

[Martin KaFai Lau]

On Mon, Apr 06, 2026 at 12:54:04PM +0800, Jiayuan Chen wrote:
> 
> On 4/6/26 11:47 AM, bot+bpf-ci@xxxxxxxxxx wrote:
> > This Fixes: tag covers the SOCK_OPS_GET_SK() portion of the fix,
> > since 84f44df664e9 introduced that macro. However, the identical
> > bug in SOCK_OPS_GET_FIELD() was introduced by an earlier commit:
> > 
> >    fd09af010788 ("bpf: sock_ops ctx access may stomp registers in corner case")
> > 
> > That commit added the dst_reg == src_reg handling to
> > SOCK_OPS_GET_FIELD() with the same missing zeroing in the
> > !fullsock path. Should this also carry:
> > 
> >    Fixes: fd09af010788 ("bpf: sock_ops ctx access may stomp registers in corner case")
> > 
> > Without it, kernels that have fd09af010788 but not 84f44df664e9
> > would not receive the SOCK_OPS_GET_FIELD() fix via stable backport.
> > 
> > 
> > ---
> > AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> > See:https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
> > 
> > CI run summary:https://github.com/kernel-patches/bpf/actions/runs/24017481706
> Well, it's true. However, fd09af010788 and 84f44df664e9 are from the
> same patchset (same author, same minute), so any stable branch carrying
> one will have both. That's why I only included a single Fixes tag.
> 
> But if you prefer carrying both explicitly, I'm happy to add it in next
> version.

Please list both in the Fixes tags so that it is clear both bugs will
be fixed. Thanks.