Re: [PATCH bpf-next v2 2/2] selftests/bpf: Cover scalar arena frees below the base

[bot+bpf-ci]

>     selftests/bpf: Cover scalar arena frees below the base
>
>     Add a verifier_arena case that fills a two-page arena, calls
>     bpf_arena_free_pages() with a scalar address one page below the arena
>     base, and then verifies that another allocation is still rejected.
>
>     Before the runtime guard, the invalid free can repopulate the free
>     tree with an out-of-domain offset and the final allocation succeeds.
>
>     Reviewed-by: Emil Tsalapatis <emil@xxxxxxxxxxxxxxx>
>     Signed-off-by: Yiyang Chen <chenyy23@xxxxxxxxxxxxxxxxxxxxx>

This test covers a memory-safety issue where bpf_arena_free_pages()
accepts a scalar address below the arena base and repopulates the free
tree with an out-of-domain offset, so a later allocation can return an
address below the arena mapping.

The clipping logic in arena_free_pages() that only bounded the upper end
(uaddr_end = min(...)) without checking full_uaddr >= arena->user_vm_start
was introduced in commit 317460317a02a.  The paired kernel fix
a6ceda1f4a47 also carries that tag.

Should this include:

  Fixes: 317460317a02a ("bpf: Introduce bpf_arena.")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/29583169394