[PATCH] cgroup/rstat: validate cpu before css_rstat_cpu() access

[PATCH] cgroup/rstat: validate cpu before css_rstat_cpu() access

[Qing Ming]

css_rstat_updated() is exposed as a BPF kfunc and accepts a
caller-provided cpu argument. The function uses cpu for per-cpu rstat
lookups without checking whether it refers to a valid possible CPU.

A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an
invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==
0x7fffffff triggers:

  UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9
  index 2147483647 is out of range for type 'long unsigned int [64]'
  Call Trace:
    css_rstat_updated
    bpf_iter_run_prog
    cgroup_iter_seq_show
    bpf_seq_read

Reject invalid cpu values before css_rstat_cpu() access.

Fixes: a319185be9f5 ("cgroup: bpf: enable bpf programs to integrate with rstat")
Signed-off-by: Qing Ming <a0yami@mailbox.org>
---
 kernel/cgroup/rstat.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c
index 150e5871e66f..b70b57b9345b 100644
--- a/kernel/cgroup/rstat.c
+++ b/kernel/cgroup/rstat.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 #include "cgroup-internal.h"
 
+#include <linux/cpumask.h>
 #include <linux/sched/cputime.h>
 
 #include <linux/bpf.h>
@@ -90,6 +91,9 @@ __bpf_kfunc void css_rstat_updated(struct cgroup_subsys_state *css, int cpu)
 	     !IS_ENABLED(CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS)) && in_nmi())
 		return;
 
+	if (unlikely(cpu < 0 || cpu >= nr_cpu_ids || !cpu_possible(cpu)))
+		return;
+
 	rstatc = css_rstat_cpu(css, cpu);
 	/*
 	 * If already on list return. This check is racy and smp_mb() is needed
-- 
2.53.0

Re: [PATCH] cgroup/rstat: validate cpu before css_rstat_cpu() access

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The `css_rstat_updated` kfunc is vulnerable to a kernel panic if a BPF tracing program passes a `css` pointer where `css->rstat_cpu` is uninitialized (NULL).
--

commit e8d546639085dcc3eee578c0dace07ba513cb482
Author: Qing Ming <a0yami@mailbox.org>

cgroup/rstat: validate cpu before css_rstat_cpu() access

This commit adds a bounds and validity check for the cpu parameter in
css_rstat_updated() to prevent an out-of-bounds array access when called
from a BPF program.

> diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c
> --- a/kernel/cgroup/rstat.c
> +++ b/kernel/cgroup/rstat.c
[ ... ]
> @@ -90,6 +91,9 @@ __bpf_kfunc void css_rstat_updated(struct cgroup_subsys_state *css, int cpu)
>  	     !IS_ENABLED(CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS)) && in_nmi())
>  		return;
>  
> +	if (unlikely(cpu < 0 || cpu >= nr_cpu_ids || !cpu_possible(cpu)))
> +		return;
> +
>  	rstatc = css_rstat_cpu(css, cpu);

Could this still lead to a panic if css->rstat_cpu is uninitialized?

The existing check at the top of this function:

    if (!css_uses_rstat(css))
        return;

only verifies that css->ss->css_rstat_flush is defined. It doesn't appear
to check if the per-cpu memory css->rstat_cpu has actually been allocated.

If a BPF program intercepts a css object during allocation (for example, by
tracing init_and_link_css before css_rstat_init completes), or if an
untrusted pointer is passed because the kfunc lacks KF_TRUSTED_ARGS,
css->rstat_cpu could be NULL.

In that scenario, css_rstat_cpu() would compute per_cpu_ptr(NULL, cpu),
which returns an offset from NULL rather than a valid memory address. The
subsequent call to llist_on_list() would then dereference this invalid
address.

Should there be an explicit check for !css->rstat_cpu to safely handle
uninitialized rstat state from BPF callers?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260515122952.59209-1-a0yami@mailbox.org?part=1

Re: [PATCH] cgroup/rstat: validate cpu before css_rstat_cpu() access

[Tejun Heo]

On Fri, May 15, 2026 at 08:29:52PM +0800, Qing Ming wrote:
> @@ -90,6 +91,9 @@ __bpf_kfunc void css_rstat_updated(struct cgroup_subsys_state *css, int cpu)
>  	     !IS_ENABLED(CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS)) && in_nmi())
>  		return;
>  
> +	if (unlikely(cpu < 0 || cpu >= nr_cpu_ids || !cpu_possible(cpu)))
> +		return;
> +

Can you please add this validation to the BPF kfunc that's exposing it?

Thanks.

-- 
tejun