[PATCH bpf] bpf: Fix out-of-bounds read in bpf_obj_memcpy

[PATCH bpf] bpf: Fix out-of-bounds read in bpf_obj_memcpy

[Jiayuan Chen]

When copying map value between two maps in BPF program, an out-of-bounds
read can occur in bpf_obj_memcpy(). Consider the following scenario:
    // map1: BPF_MAP_TYPE_CGROUP_STORAGE, value_size = 4
    // map2: BPF_MAP_TYPE_LRU_PERCPU_HASH, value_size = 4
    void *src = bpf_get_local_storage(&map1, 0);  // 4-byte buffer
    bpf_map_update_elem(&map2, &key, src, 0);     // copy src to map2

The verifier validates that source buffer size >= destination map's
value_size through check_helper_mem_access(). Since both maps have
value_size=4, verification passes.

However, at runtime bpf_obj_memcpy() rounds up the copy size to 8 bytes
for long-aligned atomic copy:
    bpf_long_memcpy(dst, src, round_up(size, 8));  // reads 8 bytes

This causes a 4-byte over-read from the source buffer. Fix this by using
round_down() to only copy complete 8-byte chunks with bpf_long_memcpy(),
then copy any remaining bytes with regular memcpy().

This ensures we never read beyond the validated buffer size while still
maintaining atomic operations where possible.

Fixes: d3bec0138bfbe ("bpf: Zero-fill re-used per-cpu map element")
Closes: https://lore.kernel.org/bpf/14e6c70c.6c121.19c0399d948.Coremail.kaiyanm@hust.edu.cn/
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 include/linux/bpf.h | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 05b34a6355b03..1b789f9f8a095 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -535,10 +535,15 @@ static inline void bpf_obj_memcpy(struct btf_record *rec,
 	int i;
 
 	if (IS_ERR_OR_NULL(rec)) {
-		if (long_memcpy)
-			bpf_long_memcpy(dst, src, round_up(size, 8));
-		else
+		u32 aligned = round_down(size, 8);
+
+		if (long_memcpy && aligned) {
+			bpf_long_memcpy(dst, src, aligned);
+			if (size > aligned)
+				memcpy(dst + aligned, src + aligned, size - aligned);
+		} else {
 			memcpy(dst, src, size);
+		}
 		return;
 	}
 
-- 
2.43.0

Re: [PATCH bpf] bpf: Fix out-of-bounds read in bpf_obj_memcpy

[Jiayuan Chen]

On 4/8/26 6:04 PM, Jiayuan Chen wrote:
> When copying map value between two maps in BPF program, an out-of-bounds
> read can occur in bpf_obj_memcpy(). Consider the following scenario:
>      // map1: BPF_MAP_TYPE_CGROUP_STORAGE, value_size = 4
>      // map2: BPF_MAP_TYPE_LRU_PERCPU_HASH, value_size = 4
>      void *src = bpf_get_local_storage(&map1, 0);  // 4-byte buffer
>      bpf_map_update_elem(&map2, &key, src, 0);     // copy src to map2
>
> The verifier validates that source buffer size >= destination map's
> value_size through check_helper_mem_access(). Since both maps have
> value_size=4, verification passes.
>
> However, at runtime bpf_obj_memcpy() rounds up the copy size to 8 bytes
> for long-aligned atomic copy:
>      bpf_long_memcpy(dst, src, round_up(size, 8));  // reads 8 bytes
>
> This causes a 4-byte over-read from the source buffer. Fix this by using
> round_down() to only copy complete 8-byte chunks with bpf_long_memcpy(),
> then copy any remaining bytes with regular memcpy().
>
> This ensures we never read beyond the validated buffer size while still
> maintaining atomic operations where possible.
>
> Fixes: d3bec0138bfbe ("bpf: Zero-fill re-used per-cpu map element")
> Closes: https://lore.kernel.org/bpf/14e6c70c.6c121.19c0399d948.Coremail.kaiyanm@hust.edu.cn/
> Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
> Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
> Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
>   include/linux/bpf.h | 11 ++++++++---
>   1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index 05b34a6355b03..1b789f9f8a095 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -535,10 +535,15 @@ static inline void bpf_obj_memcpy(struct btf_record *rec,
>   	int i;
>   
>   	if (IS_ERR_OR_NULL(rec)) {
> -		if (long_memcpy)
> -			bpf_long_memcpy(dst, src, round_up(size, 8));
> -		else
> +		u32 aligned = round_down(size, 8);
> +
> +		if (long_memcpy && aligned) {
> +			bpf_long_memcpy(dst, src, aligned);
> +			if (size > aligned)
> +				memcpy(dst + aligned, src + aligned, size - aligned);
> +		} else {
>   			memcpy(dst, src, size);
> +		}
>   		return;
>   	}
>   

This seems to already exist....

https://lore.kernel.org/bpf/7653EEEC2BAB17DF+20260402073948.2185396-1-xulang@uniontech.com/

pw-bot: cr