[PATCH bpf-next v4 0/8] Fix generic __uninit kfunc output buffers

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

Generic __uninit kfunc arguments are output buffers. Stack liveness treats
them as writes, but argument checking still requires readable contents and
does not record definite initialization after the call. Check these
arguments as write-only and record their initialization after validating all
inputs, including inputs that alias an output.

Following Eduard's rework, helpers and kfuncs now record generic outputs in
the same argument-checking path after type resolution. Their memory access
checks also use the same argument flags. This includes a separate helper
fix: MEM_WRITE without MEM_UNINIT requires read as well as write permission.
The helper fix and its permission tests remain separate from the original
kfunc fix and its immediate tests.

Changelog:
----------
v3 -> v4
v3: https://lore.kernel.org/bpf/20260916192805.3991983-1-memxor@gmail.com

 * Record helper and kfunc outputs after type resolution. (Eduard, Amery)
 * Derive generic memory access from flags for helpers and kfuncs. (Eduard)
 * Fix MEM_WRITE read checks separately and add permission tests. (Eduard)
 * Remove the output-count validator in the multiple-output extension.
   (Amery)
 * Clarify argument-slot naming and move its accessor into the fix. (BPF CI)
 * Add the unaligned header and order the new test registrations. (BPF CI)
 * Shorten the kfunc fix description while retaining its rationale. (BPF CI)

v2 -> v3
v2: https://lore.kernel.org/bpf/20260916160821.3157543-1-memxor@gmail.com

 * Reuse check_raw_mode_ok() after kfunc prototype generation, including
   struct outputs resolved to generic memory later. (Amery)
 * Remove the now-redundant kfunc output-count check in the multiple-output
   extension and simplify the helper validator.
 * Leave the stack-passed output uninitialized so the reduced-capability
   test detects missing __uninit handling. (Sashiko)

v1 -> v2
v1: https://lore.kernel.org/bpf/20260915141004.1196460-1-memxor@gmail.com

 * Separate the single-output fix and tests from multiple-output support
   and its tests; reduce coverage to focused cases. (Eduard)
 * Skip inactive output slots before looking up argument register state.
   (Sashiko, Amery)
 * Separate sysctl restrictions from mitigation-related test skips.
   (BPF CI)
 * Use an int-width initialization store in the alias test for big-endian
   targets. (BPF CI)
 * Centralize conversion from argument numbers to slots. (Eduard)
 * Share clear access-mode selection between fixed-size and sized arguments.
   (Amery)
 * Clarify the opt-in prepare/load capability boundary and retain the
   reduced-capability alias rejection test. (Eduard)

Eduard Zingerman (3):
  bpf: Record raw memory arguments during argument checking
  bpf: Check read access for initialized writable memory arguments
  selftests/bpf: Cover helper memory access permissions

Kumar Kartikeya Dwivedi (5):
  selftests/bpf: Allow privileged preparation for capability tests
  bpf: Fix generic __uninit kfunc output buffers
  selftests/bpf: Cover generic __uninit output initialization
  bpf: Support multiple __uninit kfunc output arguments
  selftests/bpf: Cover __uninit kfunc output argument slots

 Documentation/bpf/kfuncs.rst                  |  27 +++-
 include/linux/bpf_verifier.h                  |  11 +-
 kernel/bpf/verifier.c                         | 131 ++++++++++--------
 .../selftests/bpf/prog_tests/verifier.c       |   4 +
 tools/testing/selftests/bpf/progs/bpf_misc.h  |   9 +-
 .../progs/verifier_helper_access_var_len.c    |  41 ++++++
 .../bpf/progs/verifier_kfunc_uninit.c         | 100 +++++++++++++
 .../bpf/progs/verifier_kfunc_uninit_multi.c   | 113 +++++++++++++++
 .../selftests/bpf/progs/verifier_mtu.c        |  75 ++++++++++
 .../selftests/bpf/test_kmods/bpf_testmod.c    |  45 ++++++
 .../bpf/test_kmods/bpf_testmod_kfunc.h        |   7 +
 tools/testing/selftests/bpf/test_loader.c     |  48 +++++--
 tools/testing/selftests/bpf/unpriv_helpers.c  |  16 ++-
 tools/testing/selftests/bpf/unpriv_helpers.h  |   2 +
 14 files changed, 536 insertions(+), 93 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/verifier_kfunc_uninit.c
 create mode 100644 tools/testing/selftests/bpf/progs/verifier_kfunc_uninit_multi.c


base-commit: 961b8946acb482b6d7a39c266d623e5f9c4e873f
-- 
2.53.0