[PATCH bpf-next v1 0/3] Fix fastcall rewrite with indirect stack accesses

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

When a bpf_fastcall call is inlined, the verifier removes the spill/fill
pairs around it and shrinks the stack frame to exclude their slots. Two
kinds of stack access skip the check that must disable this rewrite, so
the program can then access kernel stack outside its frame.

Patch 1 checks helper and kfunc stack buffers, which BPF CI reported
after commit 5da4a9f26fca ("bpf: Preserve stack initialization for
generic output buffers"). Patch 2 makes a callee's load from its
caller's stack check the caller's frame. Patch 3 adds tests.

Kumar Kartikeya Dwivedi (3):
  bpf: Check fastcall contract for helper and kfunc stack buffers
  bpf: Check fastcall contract of the frame a stack read targets
  selftests/bpf: Test fastcall rewrite with indirect stack accesses

 kernel/bpf/verifier.c                         |  10 +-
 .../bpf/progs/verifier_bpf_fastcall.c         | 161 ++++++++++++++++++
 2 files changed, 169 insertions(+), 2 deletions(-)


base-commit: 91f8613d95ad8cd99d8baf094806d1ef98bc6380
-- 
2.53.0