Re: [PATCH] bpf: Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@xxxxxxxxxx>:

On Wed,  7 Jan 2026 07:40:37 +0530 you wrote:
> BPF_MAP_TYPE_INSN_ARRAY maps store instruction pointers in their
> ips array, not string data. The map_direct_value_addr callback for
> this map type returns the address of the ips array, which is not
> suitable for use as a constant string argument.
> 
> When a BPF program passes a pointer to an insn_array map value as
> ARG_PTR_TO_CONST_STR (e.g., to bpf_snprintf), the verifier's
> null-termination check in check_reg_const_str() operates on the
> wrong memory region, and at runtime bpf_bprintf_prepare() can read
> out of bounds searching for a null terminator.
> 
> [...]

Here is the summary with links:
  - bpf: Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str()
    https://git.kernel.org/bpf/bpf/c/9df5fad801c5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html