Re: [PATCH bpf] bpf: Zero-fill non-target CPU slots on BPF_F_CPU insert of new per-CPU element

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] bpf: unreachable dead code added in pcpu_init_value()
--

commit aa9c1147874e7681c03a2eaf750ae6f2bf2a633a
Author: Ömer Mete Kaya <omermetekaya0@gmail.com>

bpf: Zero-fill non-target CPU slots on BPF_F_CPU insert of new per-CPU element

pcpu_copy_value() with BPF_F_CPU copies the value only to the target
CPU's slot and returns immediately, leaving all other CPUs untouched.
When inserting a *new* element, the backing per-CPU area may be reused
from bpf_mem_cache or a prealloc freelist without being zero-initialized,
so non-target CPUs retain stale contents of a previously-deleted
element in the same map — a same-map information disclosure.

> diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
> index 548eb1cc7c45c..f426d4c00bdc8 100644
> --- a/kernel/bpf/hashtab.c
> +++ b/kernel/bpf/hashtab.c
> @@ -1086,6 +1086,16 @@ static void pcpu_init_value(struct bpf_htab *htab, void __percpu *pptr,
>  		}
>  	} else {
>  		pcpu_copy_value(htab, pptr, value, onallcpus, map_flags);
> +		if (map_flags & BPF_F_CPU) {

[Severity: Low]
Is this block reachable?

Since the preceding if statement in pcpu_init_value() evaluates
"if (!onallcpus || (map_flags & BPF_F_CPU))", the else branch will only
execute if "(map_flags & BPF_F_CPU)" evaluates to false.

This makes the newly added code here unreachable. Furthermore, the new
element initialization issue mentioned in the commit message appears to
already be handled correctly in the first branch, which already zeroes out
non-target CPUs via zero_map_value().

> +			int target = map_flags >> 32;
> +			int cpu;
> +
> +			for_each_possible_cpu(cpu) {
> +				if (cpu != target)
> +					zero_map_value(&htab->map,
> +						       per_cpu_ptr(pptr, cpu));
> +			}
> +		}
>  	}
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928214932.544124-1-omermetekaya0@gmail.com?part=1