Re: [PATCH bpf-next 1/2] bpf: Fix uninit read for helper mem args on partially spilled slots

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx>:

On Fri, 25 Sep 2026 10:28:13 +0200 you wrote:
> check_stack_range_initialized() takes the spilled register path when
> bpf_is_spilled_reg(ss) holds, which, however, only looks at the last
> byte of the slot. Hence, a partially spilled scalar (on the lower part)
> bypasses the check and the following loads:
> 
> 0: (b7) r1 = 1                        ; R1=1
> 1: (63) *(u32 *)(r10 -8) = r1         ; R1=1 R10=fp0 fp-8=????1
> 2: (18) r1 = 0x0                      ; R1=map_ptr(map=rb,ks=0,vs=0)
> 4: (bf) r2 = r10                      ; R2=fp0 R10=fp0
> 5: (07) r2 += -8                      ; R2=fp-8
> 6: (b7) r3 = 8                        ; R3=8
> 7: (b7) r4 = 0                        ; R4=0
> 8: (85) call bpf_ringbuf_output#130
> ...
> 
> [...]

Here is the summary with links:
  - [bpf-next,1/2] bpf: Fix uninit read for helper mem args on partially spilled slots
    https://git.kernel.org/bpf/bpf-next/c/b3861495d2b2
  - [bpf-next,2/2] selftests/bpf: Test helper read of a narrow stack spill
    https://git.kernel.org/bpf/bpf-next/c/7af653d4ebf8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html