Re: [PATCH bpf v2] bpf: fix BPF_F_CPU validation for sparse CPU IDs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Updating a per-CPU map without BPF_F_CPU or BPF_F_ALL_CPUS reads out-of-bounds from the user-provided buffer when CPU IDs are sparse, leading to a kernel memory leak into the map.
- [High] The BPF helper bpf_map_lookup_percpu_elem() lacks a check for impossible CPU IDs, allowing BPF programs to trigger a kernel panic.
--

--- Patch [1]: [PATCH bpf v2] bpf: fix BPF_F_CPU validation for sparse CPU IDs ---
commit a52d0045a4c161f0602130ac0b1b17e4a87469ee
Author: Hui Su <sh_def@163.com>

bpf: fix BPF_F_CPU validation for sparse CPU IDs

This commit updates BPF_F_CPU validation to check the CPU ID against
nr_cpu_ids and cpu_possible() instead of num_possible_cpus(). This fixes an
issue on systems with sparse CPU IDs where valid CPUs were rejected and
invalid CPUs could trigger an out-of-bounds access.

Link: https://lore.kernel.org/lkml/20260813101229.680523-3-sh_def@163.com/

> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index f4e8d372253ac..0ac809800a855 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -4200,7 +4200,7 @@ static inline int bpf_map_check_op_flags(struct bpf_map *map, u64 flags, u64 all
>  			return -EINVAL;
>  
>  		cpu = flags >> 32;
> -		if ((flags & BPF_F_CPU) && cpu >= num_possible_cpus())
> +		if ((flags & BPF_F_CPU) && (cpu >= nr_cpu_ids || !cpu_possible(cpu)))

[Severity: High]
This is a pre-existing issue, but while looking at this fix for sparse
CPU IDs, is there an out-of-bounds read in the per-CPU map update paths?

In kernel/bpf/syscall.c:bpf_map_value_size(), the buffer is sized using
num_possible_cpus():

    return round_up(map->value_size, 8) * num_possible_cpus();

But in kernel/bpf/arraymap.c:bpf_percpu_array_update(), the read offset
uses the physical CPU ID:

    val = (map_flags & BPF_F_ALL_CPUS) ? value : value + size * cpu;
    copy_map_value(map, ptr, val);

If there is a hole in the CPU mask, a physical CPU ID can be greater than
or equal to num_possible_cpus(). Does this allow the copy to read past
the end of the allocated buffer and leak memory into the map? Similar
logic exists in kernel/bpf/hashtab.c:pcpu_copy_value() and
kernel/bpf/local_storage.c:bpf_percpu_cgroup_storage_update().

[Severity: High]
This isn't a bug introduced by this patch, but does the BPF helper
bpf_map_lookup_percpu_elem() also need this cpu_possible() check?

In kernel/bpf/arraymap.c:percpu_array_map_lookup_percpu_elem() (and
similar hash and LRU functions), there is only a check for nr_cpu_ids:

    if (cpu >= nr_cpu_ids)
        return NULL;

If a BPF program passes an impossible CPU ID that falls within a device
tree hole, could per_cpu_ptr() use an unmapped or uninitialized
__per_cpu_offset, leading to a kernel panic when the BPF program
dereferences it?

>  			return -ERANGE;
>  	}
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260813160858.1042834-3-sh_def@163.com?part=1