Re: [PATCH bpf] bpf: Add missing access_ok call to copy_user_syms

["Emil Tsalapatis" <emil@etsalapatis.com>]

On Tue Jun 16, 2026 at 4:30 AM EDT, Jiri Olsa wrote:
> As reported by sashiko we use __get_user without prior access_ok call on the
> user space pointer. Adding the missing call for the whole pointer array.
>
> Plus removing the err check in the error path, because it's not needed and
> also we can return -ENOMEM directly from the first kvmalloc_array fail path.
>
> Cc: stable@vger.kernel.org
> [1] https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/
> Fixes: 0236fec57a15 ("bpf: Resolve symbols with ftrace_lookup_symbols for kprobe multi link")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

> ---
>  kernel/trace/bpf_trace.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 82f8feea6931..75495a5c3507 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -2376,9 +2376,12 @@ static int copy_user_syms(struct user_syms *us, unsigned long __user *usyms, u32
>  	int err = -ENOMEM;
>  	unsigned int i;
>  
> +	if (!access_ok(usyms, cnt * sizeof(*usyms)))
> +		return -EFAULT;
> +
>  	syms = kvmalloc_array(cnt, sizeof(*syms), GFP_KERNEL);
>  	if (!syms)
> -		goto error;
> +		return -ENOMEM;
>  
>  	buf = kvmalloc_array(cnt, KSYM_NAME_LEN, GFP_KERNEL);
>  	if (!buf)
> @@ -2403,10 +2406,8 @@ static int copy_user_syms(struct user_syms *us, unsigned long __user *usyms, u32
>  	return 0;
>  
>  error:
> -	if (err) {
> -		kvfree(syms);
> -		kvfree(buf);
> -	}
> +	kvfree(syms);
> +	kvfree(buf);
>  	return err;
>  }
>