[PATCH bpf v2] bpf: fix BPF_F_CPU validation for sparse CPU IDs

[PATCH bpf v2] bpf: fix BPF_F_CPU validation for sparse CPU IDs

[Hui Su]

BPF_F_CPU stores the target CPU ID in the upper 32 bits of the map
operation flags. bpf_map_check_op_flags() currently compares that ID
with num_possible_cpus(), which is the number of possible CPUs rather
than a bound on CPU IDs.

On an arm64 QEMU guest with a CPU device-tree hole, the possible CPU
mask was 0,2-3. A userspace program using raw bpf() syscalls creates
a BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations
for each CPU by setting BPF_F_CPU and the CPU ID in the flags.

With the old check, CPU 1 is incorrectly accepted while valid CPU 3 is
rejected with -ERANGE. The CPU 1 update then reaches the per-CPU map
access path and triggers:

  Unable to handle kernel paging request at virtual address ...
  pc : __pi_memcpy_generic+0x5c/0x22c
  lr : bpf_percpu_array_update+0x2dc/0x2e8
  Call trace:
    __pi_memcpy_generic
    bpf_map_update_value
    map_update_elem
    __sys_bpf

Check the CPU ID against nr_cpu_ids and cpu_possible() instead. This
rejects CPU IDs outside the valid range and CPUs absent from the
possible mask, while allowing valid sparse CPU IDs.

Fixes: 2b421662c788 ("bpf: Introduce BPF_F_CPU and BPF_F_ALL_CPUS flags")
Acked-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Hui Su <sh_def@163.com>
---
Changes in v2:
- Keep the CPU ID check on one line as suggested by the review.
- Add Leon Hwang's Acked-by tag.

v1 Link: https://lore.kernel.org/lkml/20260813101229.680523-3-sh_def@163.com/

 include/linux/bpf.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 7719f6528445..353f13bb066d 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -4202,7 +4202,7 @@ static inline int bpf_map_check_op_flags(struct bpf_map *map, u64 flags, u64 all
 			return -EINVAL;
 
 		cpu = flags >> 32;
-		if ((flags & BPF_F_CPU) && cpu >= num_possible_cpus())
+		if ((flags & BPF_F_CPU) && (cpu >= nr_cpu_ids || !cpu_possible(cpu)))
 			return -ERANGE;
 	}
 
-- 
2.54.0

Re: [PATCH bpf v2] bpf: fix BPF_F_CPU validation for sparse CPU IDs

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Andrii Nakryiko <andrii@kernel.org>:

On Fri, 14 Aug 2026 00:09:00 +0800 you wrote:
> BPF_F_CPU stores the target CPU ID in the upper 32 bits of the map
> operation flags. bpf_map_check_op_flags() currently compares that ID
> with num_possible_cpus(), which is the number of possible CPUs rather
> than a bound on CPU IDs.
> 
> On an arm64 QEMU guest with a CPU device-tree hole, the possible CPU
> mask was 0,2-3. A userspace program using raw bpf() syscalls creates
> a BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations
> for each CPU by setting BPF_F_CPU and the CPU ID in the flags.
> 
> [...]

Here is the summary with links:
  - [bpf,v2] bpf: fix BPF_F_CPU validation for sparse CPU IDs
    https://git.kernel.org/bpf/bpf/c/ed54bf564ac5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html