Re: [PATCH bpf-next v2 2/3] bpf: Check tail zero of bpf_prog_info

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] ABI Breakage / UAPI Regression: Enforcing a zero-check on previously unchecked UAPI struct padding actively breaks backwards compatibility for existing userspace applications.
--

commit 5d5895c0d685510901c044426a4ec3d4faf9bea8
Author: Leon Hwang <leon.hwang@linux.dev>

bpf: Check tail zero of bpf_prog_info

This commit changes the size passed to bpf_check_uarg_tail_zero() from
sizeof(info) to offsetofend() to validate the padding bytes of struct
bpf_prog_info.

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 1007fb7c87e91..0c86a70d31c17 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -5115,10 +5115,11 @@ static int bpf_prog_get_info_by_fd(struct file *file,
>  	u32 info_len = attr->info.info_len;
>  	struct bpf_prog_kstats stats;
>  	char __user *uinsns;
> -	u32 ulen;
> +	u32 ulen, len;
>  	int err;
>  
> -	err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), sizeof(info), info_len);
> +	len = offsetofend(struct bpf_prog_info, attach_btf_id);
> +	err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), len, info_len);

[Severity: Critical]
Will this cause a regression for existing userspace programs?

Since struct bpf_prog_info has trailing padding due to alignment rules,
existing userspace programs allocating this struct on the stack might pass the
full sizeof(info) via info_len without explicitly zero-initializing the
trailing padding.

Previously, because expected_size was sizeof(info), the padding bytes were not
checked. With this change, bpf_check_uarg_tail_zero() will now check those
uninitialized padding bytes against zero.

If they contain stack garbage, the syscall will unexpectedly fail with -E2BIG.
Does this actively reject previously functioning userspace code?

>  	if (err)
>  		return err;
>  	info_len = min_t(u32, sizeof(info), info_len);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260604150505.99129-1-leon.hwang@linux.dev?part=2