[PATCH bpf v3 0/2] bpf: Reject bare pointer for __arg_trusted arg

[Yiyang Chen]

A global subprogram parameter tagged __arg_trusted is verified as holding a
PTR_TRUSTED pointer, but its call-site type check also accepts bare
PTR_TO_BTF_ID. This lets a caller pass a pointer without lifetime protection
to code verified for raw trusted-pointer accesses.

Reject the bare pointer while preserving referenced, trusted, and
RCU-protected arguments. The latter is used by sched-ext programs that pass
the result of an RCU-protected kfunc through trusted-and-nullable global
subprogram arguments.

Add a rejection test for the bare pointer and a positive regression test for
the RCU-protected case.

This series targets bpf, which uses separate global-subprogram and kfunc
argument checkers.

Changes in v3:
- Preserve RCU-protected arguments accepted by existing sched-ext programs.
- Make the MEM_RCU case a positive regression test.
- Use the preferred multi-line comment style.
- Link to v2: https://lore.kernel.org/r/20261005-a3-arg-trusted-v4-v2-0-319ce2936949@xxxxxxxxxxxxxxxxxxxxx

Changes in v2:
- Retarget the fix to btf_check_func_arg_match(), where the subprogram
  argument check lives in this tree, instead of check_func_arg().
- Run the check after check_reg_type() and check_func_arg_reg_off() so type
  and offset diagnostics keep their wording.

v1: https://lore.kernel.org/bpf/20261005-a3-arg-trusted-v4-v1-0-50ee0268fd39@xxxxxxxxxxxxxxxxxxxxx/

---
Yiyang Chen (2):
      bpf: Reject bare pointer for __arg_trusted arg
      selftests/bpf: Cover bare and RCU __arg_trusted arguments

 kernel/bpf/verifier.c                              | 24 +++++++++++++++
 .../selftests/bpf/progs/verifier_global_ptr_args.c | 34 ++++++++++++++++++++++
 2 files changed, 58 insertions(+)

base-commit: ff47652a4b66c067c765a7ad464d930b5a9367cc
change-id: 20261005-a3-arg-trusted-v4-9d5d9485e5ba
-- 
Yiyang Chen <chenyy23@xxxxxxxxxxxxxxxxxxxxx>