Re: [PATCH bpf-next v1 0/6] bpf: Scope callback arguments to their frame

[Kumar Kartikeya Dwivedi]

On Tue Sep 22, 2026 at 3:55 AM CEST, Alexei Starovoitov wrote:
> On Mon, Sep 21, 2026 at 06:03 PM Ihor Solodrai <ihor.solodrai@xxxxxxxxx> wrote:
>
>> Neither has a local fix: both arguments point into a helper's own
>> frame, with nothing longer-lived to anchor them to.
>
> It's the same problem as a pointer to callee's stack.
> check_stack_write_fixed_off() deals with it like this:
>   if (state != cur && reg->type == PTR_TO_STACK) {
>           verbose(env, "cannot spill pointers to stack into stack frame of the caller\n");
>           return -EINVAL;
>   }
> CONST_PTR_TO_DYNPTR wasn't spillable before 7.3, so nothing depends
> on parking it in the caller's frame. Reject it there too ?
> and then no need for REF_TYPE_FRAME complexity?

+1, will be much simpler fix.