[PATCH bpf] bpf: Fix out-of-bounds read in bpf_obj_memcpy

Jiayuan Chen
2026-04-08T10:05:18Z

When copying map value between two maps in BPF program, an out-of-bounds
read can occur in bpf_obj_memcpy(). Consider the following scenario:
// map1: BPF_MAP_TYPE_CGROUP_STORAGE, value_size = 4
// map2: BPF_MAP_TYPE_LRU_PERCPU_HASH, value_size = 4
void *src = bpf_get_local_storage(&map1, 0); // 4-byte buffer
bpf_map_update_elem(&map2, &key, src, 0); // copy src to map2

The verifier validates that source buffer size >= destination map's
value_size through check_helper_mem_access(). Since both maps have
value_size=4, verification passes.

However, at runtime bpf_obj_memcpy() rounds up the copy size to 8 bytes
for long-aligned atomic copy:
bpf_long_memcpy(dst, src, round_up(size, 8)); // reads 8 bytes

This causes a 4-byte over-read from the source buffer. Fix this by using
round_down() to only copy complete 8-byte chunks with bpf_long_memcpy(),
then copy any remaining bytes with regular memcpy().

This ensures we never read beyond the validated buffer size while still
maintaining atomic operations where possible.

Fixes: d3bec0138bfbe ("bpf: Zero-fill re-used per-cpu map element")
Closes: https://lore.kernel.org/bpf/14e6c70c.6c121.19c0399d948.Coremail.kaiyanm@hust.edu.cn/
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
include/linux/bpf.h | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 05b34a6355b03..1b789f9f8a095 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -535,10 +535,15 @@ static inline void bpf_obj_memcpy(struct btf_record *rec,
int i;

if (IS_ERR_OR_NULL(rec)) {
- if (long_memcpy)
- bpf_long_memcpy(dst, src, round_up(size, 8));
- else
+ u32 aligned = round_down(size, 8);
+
+ if (long_memcpy && aligned) {
+ bpf_long_memcpy(dst, src, aligned);
+ if (size > aligned)
+ memcpy(dst + aligned, src + aligned, size - aligned);
+ } else {
memcpy(dst, src, size);
+ }
return;
}

--
2.43.0