Hello:
This series was applied to bpf/bpf-next.git (master)
by Kumar Kartikeya Dwivedi <[email protected]>:
On Tue, 09 Jun 2026 22:43:49 +0800 you wrote:
> check_mem_reg() verifies both read and write access when a caller passes
> memory into a global subprogram. For PTR_TO_BTF_ID callers,
> check_helper_mem_access() currently always checks the access as BPF_READ.
>
> That lets a tracing program pass a task_struct field pointer to a global
> subprogram argument typed as writable memory. The direct field store is
> rejected
> with "only read is supported", but the callee is validated with a generic
> writable PTR_TO_MEM argument and can store through it.
>
> [...]
Here is the summary with links:
- [bpf-next,1/2] bpf: Enforce write checks for BTF pointer helper access
https://git.kernel.org/bpf/bpf-next/c/fa75b7c85b0d
- [bpf-next,2/2] selftests/bpf: Cover writable BTF field global subprog args
https://git.kernel.org/bpf/bpf-next/c/af8c3f170f73
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
