Re: [PATCH bpf-next 1/2] bpf: Reject out-of-range arena free addresses

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing 32-bit boundary check in `arena_map_mmap` allows kernel PTE overwrite and sandbox escape.
--

commit d41218f03bbc51a996de1d468ac821cb61f84615
Author: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>

bpf: Reject out-of-range arena free addresses

This commit adds a check in arena_free_pages() to reject frees where the
computed full address is below arena->user_vm_start. This prevents
out-of-domain page offsets from being inserted into the free range tree.

> diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c
> index 80b7b8a694464..97a5d8d212955 100644
> --- a/kernel/bpf/arena.c
> +++ b/kernel/bpf/arena.c
> @@ -853,6 +853,8 @@ static void arena_free_pages(struct bpf_arena *arena, long uaddr, long page_cnt,
>  	uaddr &= PAGE_MASK;
>  	kaddr = bpf_arena_get_kern_vm_start(arena) + uaddr;
>  	full_uaddr = clear_lo32(arena->user_vm_start) + uaddr;
> +	if (full_uaddr < arena->user_vm_start)
> +		return;

[Severity: High]
This is a pre-existing issue, but looking at arena_map_mmap(), is it possible
for a user to dynamically choose a VMA that crosses a 32-bit boundary?

kernel/bpf/arena.c:arena_map_mmap() {
[ ... ]
	arena->user_vm_start = vma->vm_start;
	arena->user_vm_end = vma->vm_end;
[ ... ]
}

If a user maps the arena at an address crossing a 32-bit boundary (e.g.,
0x7FFF_FFFF0000 with a size of 4MB) by not specifying map_extra and using
mmap with MAP_FIXED, does this bypass the boundary check?

If so, could this lead to an overflow in arena_alloc_pages() when calculating
uaddr32?

kernel/bpf/arena.c:arena_alloc_pages() {
[ ... ]
	uaddr32 = (u32)(arena->user_vm_start + pgoff * PAGE_SIZE);

	while (remaining) {
[ ... ]
		ret = apply_to_page_range(&init_mm,
					  kern_vm_start + uaddr32 + (mapped << PAGE_SHIFT),
					  this_batch << PAGE_SHIFT, apply_range_set_cb, &data);
[ ... ]
}

When uaddr32 overflows, does the calculation kern_vm_start + uaddr32 exceed
the KERN_VM_SZ bounds? Can this overwrite PTEs of adjacent vmalloc areas?

>  	uaddr_end = min(arena->user_vm_end, full_uaddr + (page_cnt << PAGE_SHIFT));
>  	if (full_uaddr >= uaddr_end)
>  		return;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706-f01-31-arena-free-bpf-next-v1-0-3ad6e7384285@mails.tsinghua.edu.cn?part=1