Re: [PATCH] bpf: Fix alignment of memory allocator objects on 32-bit archs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] On 32-bit architectures, the verifier's hardcoded 8-byte load (BPF_DW) for bpf_this_cpu_ptr()/bpf_per_cpu_ptr() causes a KASAN out-of-bounds read past the 4-byte percpu pointer and passes garbage data on Big Endian systems.
--

--- Patch [1]: [PATCH] bpf: Fix alignment of memory allocator objects on 32-bit archs ---
commit ed5f9ae93bc0fc6463cab51b598b3ca3395812da
Author: Felix Fietkau <nbd@nbd.name>

bpf: Fix alignment of memory allocator objects on 32-bit archs

The BPF memory allocator prefixes each object with a header. On 32-bit
architectures, the memory handed out was offset by 4 bytes. This patch pads
the header to 8 bytes to preserve alignment and updates the percpu pointer
offset accordingly.

> diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c
> index e9662db7198fe..ca7555b1da34f 100644
> --- a/kernel/bpf/memalloc.c
> +++ b/kernel/bpf/memalloc.c
[ ... ]
> @@ -142,7 +142,7 @@ static void *__alloc(struct bpf_mem_cache *c, int node, gfp_t flags)
>  {
>  	if (c->percpu_size) {
> -		void __percpu **obj = kmalloc_node(c->percpu_size, flags, node);
> +		void *obj = kmalloc_node(c->percpu_size, flags, node);
>  		void __percpu *pptr = __alloc_percpu_gfp(c->unit_size, 8, flags);
>  
>  		if (!obj || !pptr) {
> @@ -150,7 +150,7 @@ static void *__alloc(struct bpf_mem_cache *c, int node, gfp_t flags)
>  			kfree(obj);
>  			return NULL;
>  		}
> -		obj[1] = pptr;
> +		*(void __percpu **)(obj + LLIST_NODE_SZ) = pptr;

[Severity: High]
This is a pre-existing issue, but does this 32-bit pointer write lead to an
out-of-bounds read when accessed by the verifier?

On 32-bit systems, the allocation size for percpu objects is typically 12
bytes (LLIST_NODE_SZ + sizeof(void *)). The percpu pointer is stored at offset
8 using a 32-bit store.

However, the verifier unconditionally patches bpf_per_cpu_ptr() and
bpf_this_cpu_ptr() to read this pointer using an 8-byte load:

kernel/bpf/fixups.c:fixup_bpf_calls() {
    ...
    insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0);
    ...
}

Could this 64-bit read access bytes 8-15 of the 12-byte allocation, causing a
KASAN slab-out-of-bounds read?

Furthermore, on 32-bit Big Endian systems, does this 8-byte load place the
4-byte pointer into the upper 32 bits and the out-of-bounds garbage into the
lower 32 bits, leading to memory corruption or a kernel panic when the garbage
is later dereferenced?

>  		return obj;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717183632.99195-1-nbd@nbd.name?part=1