From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5CD8C3B5306 for ; Mon, 6 Jul 2026 18:53:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783364023; cv=none; b=Zt6vvikmnMITSJQmk5bGIcXjWeGXgUndzScXwZxSpzs1wmTotL700NB6WnqiHXoy3plO7ONtFBOChrIpAZbuuZtR4IcddXC7RHhFVPUefSlAr/G+7MMABPm1zf4tOpQqsffGTqIBfzSoGGauDwUvQXXDAB8SUUwGYINcatI+7vE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783364023; c=relaxed/simple; bh=MpET7ucvY4RWt7XBea563Uf8ggta6J1m9GSdG8sZ3u0=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=PM6t3CTev9b21zumDYUIZR8A1fs9NhpJ7ZLch4JeXntC9uz4EqCXD7ayXYEHvhcJcoSuq0w5VQPQB/OJGhQie+/PekA+L2pd4JkbB2pK4W+UIkZocFAv46xb9Waw94/kFzbkF/ZjF21+Zr3fBf+bZpkiIt3y6tSgHyN1K0TLU1E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=i/0RCBdt; arc=none smtp.client-ip=209.85.210.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="i/0RCBdt" Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-8478cc93299so3698600b3a.2 for ; Mon, 06 Jul 2026 11:53:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783364022; x=1783968822; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=MpET7ucvY4RWt7XBea563Uf8ggta6J1m9GSdG8sZ3u0=; b=i/0RCBdtJ0qlQSZ3fzUQRQfH1E2VYbfmlaUGReShXRuN9ngYfEHReVF1Uc5QD7X1EC Nv3hgHsa9Mh2xLAqMj0Z/Ut7SynKgz6Fj8JqGClX9GAPzYiptrKz59NPskRLivkhrosw d7TDP8HfLNooOFZH18V6YRTev9N1sXz84qhDySJKEBbiRvjhYeyx4cFMVcxxG8wB4oPs 5sVWw0r8k57IFs4cbiqFvkt619Nn1ZU0oyPZaD1JQU/gKrktfAfyLm7lS28BRtWqFSfd y+mpimF8V1uCamyKQhiNm0vu030tGl+oUlDOD/YYYrFYtJoyQGuQkD73B/jCoH+TK5WV eevw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783364022; x=1783968822; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=MpET7ucvY4RWt7XBea563Uf8ggta6J1m9GSdG8sZ3u0=; b=jri7VeKYOMaTCuRe0UM7q/ZkeiDFTbVSf+bpWDQ0+yNCVkiK2Cg4e5Q3QIKYM/zE0S aRDDZORsVOaeBs/GH1FQ3mGZfLHUFReoSY+S5Oq4jwBHBxqAp7WFdRzYRIIVFjtYN4wG 4RATY0uwfeEu9WOdKn8ZlXUeD7mA08Yo1rhQMhhp4+2tR6kT6xmBSatLGVs4WMELFJRv Fl2VvXWzpg9zat8uil02nkVd4I7MW6Kmx7jDTBMbjZ4kVSaEGuZ723YLMJveBWd3jB4T UZnYqdv2Ex788vxGArr5U7VMbAO+c7GGudFHyPqhA8r2hmRDWz6Rh1sxRpZtWzEmU3Tr MZ9A== X-Forwarded-Encrypted: i=1; AHgh+RpC4A1GSsb8LszjB4grqaMc+BKTjAwhP8zpGeEea3ki9M4+C0ShCWcYKK8cALvoaOKka2ageiwnAzamiIo=@vger.kernel.org X-Gm-Message-State: AOJu0YxdebM5JgMk31hdr8dp7LzWjHwhgsVAU+KoJf/FiRPS76cbSQrB ocSIJ1uG8kZQeMJkM6a0hA1XCmXQB68Rr74FIhNwYYJh8wqA6jXYqMrh X-Gm-Gg: AfdE7cni8ULFWwXJz0hFsrmDj7N8KWlbu1AAYTw51hMxcf8TEea4DYW5zvWujJU8Fz7 H+OpkPtw+zEuL62wlEP+IHBM/9kACqBmVJTNZouFRbF6vEMfrgaf7r0CCll6SBfDUALIhltD3ys pu99a+jrdq4TstSwl0t71JgkUyDveswU2hYxZud+2SBG9wD0HJcHbwi9VREVrZQe1ldsqRPU+Hm Zyu4jX87P2j1aeyhELKoLRmdUTugW9+W2QNQc++6L8VlUdNCI4zkkfEBrVLMsxSmIBm1rZEWib1 DNdBATsyqntBmvl6DEaVhGyWXlRnPnQ5fO9hqzguXL3JLgG5WlN/JJAhaMnxLQEFxuKJblVbWPx lCx46hMGKzhMWy6tWYR4wVYhT/kOqudd99AM6zWlQ+9QcOQRh1vJ8WH9nyist/JpTYE2giAebH7 taIjpbAe7Vd1eO4NbYO2ZUnB/EoYDol+2/C87Avlf7EmPNCcCOkd/1aV6bbUNXpT8DMtw0V+ndA C+qKE8P X-Received: by 2002:a05:6a20:e290:b0:3bf:6c05:a6 with SMTP id adf61e73a8af0-3c08efd986dmr2263676637.53.1783364021670; Mon, 06 Jul 2026 11:53:41 -0700 (PDT) Received: from ?IPv6:2a03:83e0:115c:1:612f:7084:be32:532a? ([2620:10d:c090:500::1:55b9]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30f0b816a42sm89531831eec.9.2026.07.06.11.53.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2026 11:53:41 -0700 (PDT) Message-ID: <9fb4401c0ea5e68b86fcc499bf23c6a7872ce5cf.camel@gmail.com> Subject: Re: [PATCH bpf-next v3 1/2] bpf: Reject MEM_ALLOC BTF accesses past object bounds From: Eduard Zingerman To: Yiyang Chen , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Kumar Kartikeya Dwivedi Cc: John Fastabend , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Shuah Khan , bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Date: Mon, 06 Jul 2026 11:53:39 -0700 In-Reply-To: <4b8c8a81102ba4b595011434c881194f264ddc59.1782807039.git.chenyy23@mails.tsinghua.edu.cn> References: <4b8c8a81102ba4b595011434c881194f264ddc59.1782807039.git.chenyy23@mails.tsinghua.edu.cn> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.60.1 (3.60.1-1.fc44) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Tue, 2026-06-30 at 08:41 +0000, Yiyang Chen wrote: > BTF struct walks relax the struct-size check for accesses through a > trailing flexible array. That is valid for ordinary BTF type walking, but > PTR_TO_BTF_ID | MEM_ALLOC values point to objects allocated with the stat= ic > BTF type size. >=20 > When walking a MEM_ALLOC object, reject the access before applying the > flexible-array relaxation if the access range extends past the struct siz= e. > Apply the same policy to struct ID matching so kfunc and kptr type checks > do not walk past the allocated object bounds either. >=20 > Fixes: 958cf2e273f0 ("bpf: Introduce bpf_obj_new") > Fixes: 36d8bdf75a93 ("bpf: Add alloc/xchg/direct_access support for local= percpu kptr") > Signed-off-by: Yiyang Chen > --- Acked-by: Eduard Zingerman (Please keep acks from revision to revision if the changes are minor). [...]