Re: [PATCH v2] bpf: Annotate bpf_obj_memcpy with data_race

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] bpf_obj_memcpy() ignores the long_memcpy parameter when a map value contains special BTF fields (rec != NULL), leading to data tearing and uninitialized memory leaks.
--

--- Patch [1]: [PATCH v2] bpf: Annotate bpf_obj_memcpy with data_race ---
commit 1f96f25bd23990e4a6c598225059cbcbac9898bf
Author: quanyeyang <quanyeyang@proton.me>

bpf: Annotate bpf_obj_memcpy with data_race

This patch annotates the ordinary memcpy() sites in bpf_obj_memcpy() with
data_race(), matching bpf_long_memcpy(). This documents the existing
concurrency semantics and suppresses KCSAN reports for intentional races
without changing behavior.

Closes: https://syzkaller.appspot.com/bug?extid=44044637ef892e79ca2b

> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index 7719f65284456..10d1186ef3b44 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
[ ... ]
> @@ -580,10 +587,10 @@ static inline void bpf_obj_memcpy(struct btf_record *rec,
>  		u32 next_off = rec->fields[i].offset;
>  		u32 sz = next_off - curr_off;
>  
> -		memcpy(dst + curr_off, src + curr_off, sz);
> +		data_race(memcpy(dst + curr_off, src + curr_off, sz));
>  		curr_off += rec->fields[i].size + sz;
>  	}
> -	memcpy(dst + curr_off, src + curr_off, size - curr_off);
> +	data_race(memcpy(dst + curr_off, src + curr_off, size - curr_off));

[Severity: High]
This is a pre-existing issue and was not introduced by this patch, but does
this code ignore the long_memcpy parameter when rec != NULL?

When rec != NULL, the loop ends by copying exactly up to size bytes and uses
byte-wise memcpy. It ignores the long_memcpy flag, losing anti-tearing
guarantees, and fails to process the remaining padding bytes up to
round_up(size, 8), leaving them uninitialized.

Could this leak uninitialized memory to userspace?

For per-CPU lookups, the destination buffer is allocated without __GFP_ZERO:

kernel/bpf/syscall.c:map_lookup_elem() {
    ...
    value = kvmalloc(value_size, GFP_USER | __GFP_NOWARN);
    ...
}

Since bpf_obj_memcpy fails to overwrite or zero the padding bytes for maps
with special BTF fields, the uninitialized kernel heap memory in the padding
is subsequently leaked to userspace.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260820-bpf-kcsan-obj-memcpy-v2-1-672517a3145f@proton.me?part=1