From: Jiayuan Chen <jiayuan.chen@linux.dev>
To: gandalf 4a <baksmali404@gmail.com>,
security@kernel.org, bpf@vger.kernel.org
Cc: st@kernel.org, daniel@iogearbox.net, andrii@kernel.org
Subject: Re: [SECURITY] KASAN global-out-of-bounds in BPF disassembler (bpf_ldsx_string, kernel 6.4+)
Date: Tue, 25 Aug 2026 17:15:42 +0800 [thread overview]
Message-ID: <29ed6371-c10f-4de5-baac-4e6f590a6ab3@linux.dev> (raw)
In-Reply-To: <CAOHg6aBPdesARUtOwR9NbsWT77L+GqTmfLGsdAQ=hf1YAGOitg@mail.gmail.com>
On 8/25/26 4:37 PM, gandalf 4a wrote:
> Hi,
> I am writing to report a KASAN-detected global-out-of-bounds read
> vulnerability in the BPF disassembler that affects Linux kernel v6.4
> and later (all versions with BPF_MEMSX support). I have attached a
> minimal C reproducer and a one-line fix patch.
> == Vulnerability Summary ==
> The bpf_ldsx_string[] array in kernel/bpf/disasm.c is missing an
> entry for BPF_DW (64-bit). The disassembler function print_bpf_insn()
> calculates the index as BPF_SIZE(insn->code) >> 3, which yields 3 for
> BPF_DW, but the array only has 3 entries (indices 0-2 for BPF_W,
> BPF_H, BPF_B). This causes an 8-byte out-of-bounds read.
> Trigger opcode: 0x99 = BPF_LDX (0x01) | BPF_MEMSX (0x80) | BPF_DW (0x18)
> == Trigger Path ==
> The crash occurs in the diagnostic printing path that runs BEFORE the
> verifier validates the instruction:
> bpf(BPF_PROG_LOAD)
> -> bpf_check() [verifier.c:21097]
> -> check_subprogs() [verifier.c:3057] <- early
> -> bpf_diag_program_structure() [diagnostics.c:1215]
> -> bpf_diag_source() [diagnostics.c:896]
> -> format_disasm_line() [diagnostics.c:633]
> -> print_bpf_insn() [disasm.c:302] <- CRASH
> The verifier correctly rejects BPF_LDX + BPF_MEMSX + BPF_DW in
Thanks for reporting this.
The issue has been fixed
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=37e5c4f4d2856290b1c56e573ced91dcd88db8ec
> check_load_mem() (verifier.c:6616-6618), but the disassembler crash
> occurs earlier in check_subprogs(), before opcode validation runs.
> == Impact ==
> - Denial of Service: With panic_on_warn=1 (common in fuzzing/test
> environments, also present in some production configs), KASAN
> detection triggers a kernel panic.
> - Unprivileged trigger: bpf(BPF_PROG_LOAD) with BPF_PROG_TYPE_SCHED_CLS
> does not require CAP_BPF. Any unprivileged user can trigger this.
> - Info leak (theoretical): On non-KASAN kernels, the 8-byte OOB read
> returns data from .rodata after bpf_ldsx_string.
> == Affected Versions ==
> Linux 6.4 (commit introducing BPF_MEMSX) through 7.2+ (latest mainline).
I don't think 6.4 suffer from this. Although the issue is associated
with BPF_MEMSX, but OOB didn't happen until a8f427835394.
prev parent reply other threads:[~2026-08-25 9:15 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-25 8:37 [SECURITY] KASAN global-out-of-bounds in BPF disassembler (bpf_ldsx_string, kernel 6.4+) gandalf 4a
2026-08-25 8:43 ` Greg KH
2026-08-25 9:15 ` Jiayuan Chen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=29ed6371-c10f-4de5-baac-4e6f590a6ab3@linux.dev \
--to=jiayuan.chen@linux.dev \
--cc=andrii@kernel.org \
--cc=baksmali404@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=security@kernel.org \
--cc=st@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.