Re: [PATCH bpf v3] bpf: Fix out-of-bounds btf->types write for split BTF

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@xxxxxxxxxx>:

On Wed, 28 Oct 2026 11:19:33 +0800 you wrote:
> From: Feng Yang <yangfeng@xxxxxxxxxx>
> 
> btf_add_type() stores the types of a BTF in btf->types[], which can hold at
> most BTF_MAX_TYPE entries.  The types of a split BTF get IDs start_id ..
> start_id + nr_types - 1, so only BTF_MAX_TYPE - start_id of them fit, but
> neither the limit check nor the size used to grow the array accounts for
> start_id: the check is an equality test against BTF_MAX_TYPE
> ('start_id + btf->types_size == BTF_MAX_TYPE') and the new size is clamped
> to BTF_MAX_TYPE.
> 
> [...]

Here is the summary with links:
  - [bpf,v3] bpf: Fix out-of-bounds btf->types write for split BTF
    https://git.kernel.org/bpf/bpf/c/6c476d2b7305

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html