From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: "Jan-Gerd Tenberge" <janten@gmail.com>, <bpf@vger.kernel.org>
Cc: <daniel@iogearbox.net>, <andrii@kernel.org>, <eddyz87@gmail.com>,
<memxor@gmail.com>, <martin.lau@linux.dev>, <song@kernel.org>,
<yonghong.song@linux.dev>, <jolsa@kernel.org>,
<emil@etsalapatis.com>, <ihor.solodrai@linux.dev>,
<john.fastabend@gmail.com>, <davem@davemloft.net>,
<edumazet@kernel.org>, <kuba@kernel.org>, <pabeni@redhat.com>,
<horms@kernel.org>, <jakub@cloudflare.com>,
<jiayuan.chen@linux.dev>, <kuniyu@google.com>,
<willemb@google.com>, <shuah@kernel.org>,
<netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<linux-kselftest@vger.kernel.org>
Subject: Re: [PATCH bpf 0/2] bpf: Fix iterator link update target validation
Date: Fri, 16 Oct 2026 00:31:18 +0000 [thread overview]
Message-ID: <DM5U7S0WO4CB.72E73EAOUSGZ@gmail.com> (raw)
In-Reply-To: <20261008161309.8179-1-janten@gmail.com>
On Thu, Oct 08, 2026 at 06:13 PM Jan-Gerd Tenberge <janten@gmail.com> wrote:
> Runtime testing in disposable QEMU guests confirmed that the resulting
> out-of-bounds access can reach kernel-owned metadata of a separately
> allocated live map and cause a deterministic kernel panic. Corrupting a
Way too long.
The prog needs CAP_BPF and CAP_PERFMON and it writes past the end
of the map value. That's all that needs to be said.
See "Length" and "Impact Evaluation" in
Documentation/process/security-bugs.rst.
Trim the commit log of patch 1 as well.
pw-bot: cr
prev parent reply other threads:[~2026-10-16 0:31 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-08 16:13 [PATCH bpf 0/2] bpf: Fix iterator link update target validation Jan-Gerd Tenberge
2026-10-08 16:13 ` [PATCH bpf 1/2] bpf: Revalidate iterator programs on link update Jan-Gerd Tenberge
2026-10-08 17:13 ` bot+bpf-ci
2026-10-08 16:13 ` [PATCH bpf 2/2] selftests/bpf: Test iterator link target validation Jan-Gerd Tenberge
2026-10-16 0:31 ` Alexei Starovoitov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DM5U7S0WO4CB.72E73EAOUSGZ@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=edumazet@kernel.org \
--cc=emil@etsalapatis.com \
--cc=horms@kernel.org \
--cc=ihor.solodrai@linux.dev \
--cc=jakub@cloudflare.com \
--cc=janten@gmail.com \
--cc=jiayuan.chen@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kuba@kernel.org \
--cc=kuniyu@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=willemb@google.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.