Re: [STABLE REQUEST] bpf: backport de36adca6346 to 7.1.y

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Aug 25, 2026 at 04:00:34AM +0900, 하태구 wrote:
> Hello,
> 
> Please consider backporting the following upstream commit to Linux 7.1.y:
> 
> de36adca634634c205a9eb8b56a28175ab7abf5f
> ("bpf: reject overlarge global subprog argument sizes")
> 
> The issue was introduced by:
> 
> 2cb27158adb3 ("bpf: poison dead stack slots")
> 
> which is present in Linux 7.1.
> 
> The fix rejects BTF-derived global subprogram argument sizes larger
> than S32_MAX. Without the check, the caller-side PTR_TO_STACK
> validation can interpret an overlarge size differently from the
> callee-side PTR_TO_MEM state, potentially allowing the verifier to
> validate accesses outside the actual stack object.
> 
> The upstream commit includes a selftest and applies cleanly to the
> current linux-7.1.y tree. The fix is present in Linux 7.2 but is not
> present in Linux 7.1.10 or the current 7.1 stable queue.
> 
> Upstream commit:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=de36adca634634c205a9eb8b56a28175ab7abf5f
> 
> Target stable series:
> 
> 7.1.y

It does not actually build properly, how did you test this?  Please
provide a working backport that has been tested if you wish to see this
added to the 7.1.y tree.

thanks,

greg k-h