[PATCH bpf v2] bpf: fix BPF_F_CPU validation for sparse CPU IDs

[PATCH bpf v2] bpf: fix BPF_F_CPU validation for sparse CPU IDs

[Hui Su]

BPF_F_CPU stores the target CPU ID in the upper 32 bits of the map
operation flags. bpf_map_check_op_flags() currently compares that ID
with num_possible_cpus(), which is the number of possible CPUs rather
than a bound on CPU IDs.

On an arm64 QEMU guest with a CPU device-tree hole, the possible CPU
mask was 0,2-3. A userspace program using raw bpf() syscalls creates
a BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations
for each CPU by setting BPF_F_CPU and the CPU ID in the flags.

With the old check, CPU 1 is incorrectly accepted while valid CPU 3 is
rejected with -ERANGE. The CPU 1 update then reaches the per-CPU map
access path and triggers:

  Unable to handle kernel paging request at virtual address ...
  pc : __pi_memcpy_generic+0x5c/0x22c
  lr : bpf_percpu_array_update+0x2dc/0x2e8
  Call trace:
    __pi_memcpy_generic
    bpf_map_update_value
    map_update_elem
    __sys_bpf

Check the CPU ID against nr_cpu_ids and cpu_possible() instead. This
rejects CPU IDs outside the valid range and CPUs absent from the
possible mask, while allowing valid sparse CPU IDs.

Fixes: 2b421662c788 ("bpf: Introduce BPF_F_CPU and BPF_F_ALL_CPUS flags")
Acked-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Hui Su <sh_def@163.com>
---
Changes in v2:
- Keep the CPU ID check on one line as suggested by the review.
- Add Leon Hwang's Acked-by tag.

v1 Link: https://lore.kernel.org/lkml/20260813101229.680523-3-sh_def@163.com/

 include/linux/bpf.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 7719f6528445..353f13bb066d 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -4202,7 +4202,7 @@ static inline int bpf_map_check_op_flags(struct bpf_map *map, u64 flags, u64 all
 			return -EINVAL;
 
 		cpu = flags >> 32;
-		if ((flags & BPF_F_CPU) && cpu >= num_possible_cpus())
+		if ((flags & BPF_F_CPU) && (cpu >= nr_cpu_ids || !cpu_possible(cpu)))
 			return -ERANGE;
 	}
 
-- 
2.54.0

Re: [PATCH bpf v2] bpf: fix BPF_F_CPU validation for sparse CPU IDs

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Updating a per-CPU map without BPF_F_CPU or BPF_F_ALL_CPUS reads out-of-bounds from the user-provided buffer when CPU IDs are sparse, leading to a kernel memory leak into the map.
- [High] The BPF helper bpf_map_lookup_percpu_elem() lacks a check for impossible CPU IDs, allowing BPF programs to trigger a kernel panic.
--

--- Patch [1]: [PATCH bpf v2] bpf: fix BPF_F_CPU validation for sparse CPU IDs ---
commit a52d0045a4c161f0602130ac0b1b17e4a87469ee
Author: Hui Su <sh_def@163.com>

bpf: fix BPF_F_CPU validation for sparse CPU IDs

This commit updates BPF_F_CPU validation to check the CPU ID against
nr_cpu_ids and cpu_possible() instead of num_possible_cpus(). This fixes an
issue on systems with sparse CPU IDs where valid CPUs were rejected and
invalid CPUs could trigger an out-of-bounds access.

Link: https://lore.kernel.org/lkml/20260813101229.680523-3-sh_def@163.com/

> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index f4e8d372253ac..0ac809800a855 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -4200,7 +4200,7 @@ static inline int bpf_map_check_op_flags(struct bpf_map *map, u64 flags, u64 all
>  			return -EINVAL;
>  
>  		cpu = flags >> 32;
> -		if ((flags & BPF_F_CPU) && cpu >= num_possible_cpus())
> +		if ((flags & BPF_F_CPU) && (cpu >= nr_cpu_ids || !cpu_possible(cpu)))

[Severity: High]
This is a pre-existing issue, but while looking at this fix for sparse
CPU IDs, is there an out-of-bounds read in the per-CPU map update paths?

In kernel/bpf/syscall.c:bpf_map_value_size(), the buffer is sized using
num_possible_cpus():

    return round_up(map->value_size, 8) * num_possible_cpus();

But in kernel/bpf/arraymap.c:bpf_percpu_array_update(), the read offset
uses the physical CPU ID:

    val = (map_flags & BPF_F_ALL_CPUS) ? value : value + size * cpu;
    copy_map_value(map, ptr, val);

If there is a hole in the CPU mask, a physical CPU ID can be greater than
or equal to num_possible_cpus(). Does this allow the copy to read past
the end of the allocated buffer and leak memory into the map? Similar
logic exists in kernel/bpf/hashtab.c:pcpu_copy_value() and
kernel/bpf/local_storage.c:bpf_percpu_cgroup_storage_update().

[Severity: High]
This isn't a bug introduced by this patch, but does the BPF helper
bpf_map_lookup_percpu_elem() also need this cpu_possible() check?

In kernel/bpf/arraymap.c:percpu_array_map_lookup_percpu_elem() (and
similar hash and LRU functions), there is only a check for nr_cpu_ids:

    if (cpu >= nr_cpu_ids)
        return NULL;

If a BPF program passes an impossible CPU ID that falls within a device
tree hole, could per_cpu_ptr() use an unmapped or uninitialized
__per_cpu_offset, leading to a kernel panic when the BPF program
dereferences it?

>  			return -ERANGE;
>  	}
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260813160858.1042834-3-sh_def@163.com?part=1