bpf: Remove dynptr check in check_stack_range_initialized()

Browse source

For a MEM_UNINIT ("raw mode") helper argument,
check_stack_range_initialized() open-coded a scan that rejected any
STACK_DYNPTR slot in the range with "potential write to dynptr". This
duplicated, and was stricter than, the handling that runs when the
buffer is actually marked initialized. check_helper_call() later replays
the write byte by byte via check_mem_access(), which goes through
destroy_if_dynptr_stack_slot(), which rejects overwritting a referenced
dynptr. Therefore drop the redundant scan and rely on check_mem_access().

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260715064047.1793790-2-ameryhung@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

...

This commit is contained in:

Amery Hung 2026-07-14 23:40:41 -07:00 • committed by Kumar Kartikeya Dwivedi

parent f68df52fba

commit c28cbef2f8

No known key found for this signature in database

GPG key ID: 472D377B63542F83

2 changed files with 2 additions and 27 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

25

kernel/bpf/verifier.c

View file

4

tools/testing/selftests/bpf/progs/dynptr_fail.c

View file