Re: [PATCH bpf-next v4 0/6] bpf: Scope callback arguments to their frame

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Fri, 13 Nov 2026 14:39:15 -0700 you wrote:
> A callback-calling helper can pass its callback a pointer that is only
> valid for the callback invocation, and the verifier has no way to
> express that lifetime.
> 
> Two helpers need fixing:
> 
>   * bpf_user_ringbuf_drain() passes a CONST_PTR_TO_DYNPTR over a
>     sample it releases as soon as the callback returns. Saving this
>     pointer in callback_ctx leaves it pointing into reused kernel
>     stack and allows arbitrary kernel read and write since v7.3.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v4,1/6] bpf: Share map-backed callback register setup
    https://git.kernel.org/bpf/bpf-next/c/acd250fab540
  - [bpf-next,v4,2/6] bpf: Rely on callback frame initialization defaults
    https://git.kernel.org/bpf/bpf-next/c/9c8582c81b7a
  - [bpf-next,v4,3/6] bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame
    https://git.kernel.org/bpf/bpf-next/c/e559d46c34cd
  - [bpf-next,v4,4/6] selftests/bpf: Cover the user ringbuf callback dynptr lifetime
    https://git.kernel.org/bpf/bpf-next/c/f4e3977ba0f7
  - [bpf-next,v4,5/6] bpf: Scope the bpf_for_each_map_elem() array key to the callback frame
    https://git.kernel.org/bpf/bpf-next/c/3be66bbbaa7d
  - [bpf-next,v4,6/6] selftests/bpf: Cover callback-frame map key lifetime
    https://git.kernel.org/bpf/bpf-next/c/9f2c5a659f0b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html