Re: [PATCH bpf-next 1/2] bpf: Drop scalar id on sign-extending narrowing stack fills

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Eduard Zingerman <eddyz87@gmail.com>:

On Thu,  9 Jul 2026 17:31:30 +0200 you wrote:
> When a spilled scalar is filled back with a sign-extending narrowing load
> (BPF_MEMSX), check_stack_read_fixed_off() copies the spilled register
> including its scalar id, but coerce_reg_to_size_sx() then sign-extends the
> filled register's value. If the same slot is also filled with a plain
> zero-extending load (BPF_MEM), both destination registers share the id yet
> hold different values. A later 'if <zext-reg> == const' then refines the
> sign-extended register through sync_linked_regs() to a value it does not
> have at runtime (e.g. the verifier believes 0x80000000 while the register
> is 0xffffffff80000000), which can be turned into an out-of-bounds access.
> 
> [...]

Here is the summary with links:
  - [bpf-next,1/2] bpf: Drop scalar id on sign-extending narrowing stack fills
    https://git.kernel.org/bpf/bpf-next/c/2cb5f4ca695e
  - [bpf-next,2/2] selftests/bpf: Add test for scalar id on sign-extending stack fill
    https://git.kernel.org/bpf/bpf-next/c/c3d5ef291a2a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html