Re: [PATCH bpf v3 0/2] bpf: reject negative CO-RE accessor indices

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Sun,  5 Apr 2026 00:12:19 +0800 you wrote:
> bpf_core_parse_spec() parses CO-RE accessor strings with sscanf("%d"),
> which accepts negative values.  The downstream bounds checks only test
> the upper bound, so a negative index like -1 slips through, gets cast
> to u32 0xffffffff in btf_member_bit_offset(), and crashes the kernel.
> 
> To clarify the kernel-side concern from v2 review:
> tools/lib/bpf/relo_core.c is shared code -- the kernel compiles it
> directly via kernel/bpf/relo_core.c (#include).  So the fix does
> apply in the kernel's BPF_PROG_LOAD -> check_core_relo() ->
> bpf_core_apply() -> bpf_core_parse_spec() path.
> 
> [...]

Here is the summary with links:
  - [bpf,v3,1/2] bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
    https://git.kernel.org/bpf/bpf-next/c/1c22483a2c4b
  - [bpf,v3,2/2] selftests/bpf: add test for negative CO-RE accessor index rejection
    (no matching commit)

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html