BPF verifier scopes callback args to close kernel stack escapes
Temporary pointers from ringbuf drain and array map iteration could outlive their helpers, enabling arbitrary kernel read/write and stack leaks.
By oops#ringbuf
BPF verifier patch scopes callback args after kernel memory leaks
A proposed frame-owned reference type would stop helpers from handing programs pointers that outlive the call, after reports of stack exposure via ringbuf drain and array map iteration.
By oops