[PATCH bpf-next v2 0/2] Fix fastcall rewrite with indirect stack accesses

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

When a bpf_fastcall call is inlined, the verifier removes the spill/fill
pairs around it and shrinks the stack frame to exclude their slots. Two
kinds of stack access skip the check that must disable this rewrite, so
the program can then access kernel stack outside its frame: stack
buffers passed to helpers and kfuncs, which BPF CI reported after commit
5da4a9f26fca ("bpf: Preserve stack initialization for generic output
buffers"), and a callee's load from its caller's stack, which checked
the callee's frame instead of the caller's.

Patch 1 moves the check into check_stack_access_within_bounds(), which
every stack access goes through with the frame that owns the slots, and
drops the calls from the stack read and write paths. Patch 2 adds tests.

Changelog:
----------
v1 -> v2
v1: https://lore.kernel.org/bpf/20260923084201.2437625-1-memxor@gmail.com

 * Check the contract once in check_stack_access_within_bounds() and drop
   the calls in the stack read and write paths, which also fixes the frame
   check_stack_read_fixed_off() checked; fold v1 patch 2 into patch 1.
   (Alexei)
 * Scope the test comment to the output buffer tests and describe the
   remaining tests individually. (BPF CI)

Kumar Kartikeya Dwivedi (2):
  bpf: Check fastcall stack contract once for all stack accesses
  selftests/bpf: Test fastcall rewrite with indirect stack accesses

 kernel/bpf/verifier.c                         |  13 +-
 .../bpf/progs/verifier_bpf_fastcall.c         | 169 ++++++++++++++++++
 2 files changed, 178 insertions(+), 4 deletions(-)


base-commit: 24629aac43d2884109ae47a993fd51b504e2b09b
-- 
2.53.0