From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 707C5373C1C for ; Thu, 12 Mar 2026 18:02:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773338527; cv=none; b=IsRblf4ZcPMIewENbMkc4IOVHmIUonFGG+wSC84msd7fRs0f7E9GJSZ+yZ0YyrodWV5MTxt1pJF6R0lHpDNYbeM1ieEXLo9KgS26TrpUIWPSs+MwWm2uudCw+2LdNbMkf1URW8oy1pymyfjruBJ77ytbcF+vtDUmfrsv9lHywmM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773338527; c=relaxed/simple; bh=xlB+u1r2QX0LI5Rj8fDdMtpNUBGNzQ4jyUCs2t92IiA=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=iMj82tqZl+wvGbhdVDyjeLRp+l9kEhjRA5x9t4xH37jevAMg0WxDHVqJMKUlRnVkZXwuMZxO0CrGgDI2DTcJxOLK+FuFqvy6OfWZRrS2a47hY98OK1iITfpNUxqOzWe5jExBUTFHg82bGiSQHrpdvcNAcRkZKF7BtM2IBcHyWAc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=M4+SXywf; arc=none smtp.client-ip=209.85.128.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="M4+SXywf" Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-48540355459so11417175e9.3 for ; Thu, 12 Mar 2026 11:02:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1773338524; x=1773943324; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=JBA5MyXByYLA3zXXjx3wMlp0Yon7kVfdTygyQg8Lb4A=; b=M4+SXywf+vlZ+0aZtr3Al0rGtNmhFFpmk+cjClwXF1ntrUYltANA2XJP7OeQUqCvIx oqafJiyQttJE7/4TCcjQAyZysTbyp1EO7woZaDZzTFCzfowgVi6+dvkZQwklwrLDBazH 1nDwii6eJQTvlUEX+0qzbW0DQFi5aqZDm9699kpJRXybO3e0bUu8asuChnTlFScTYNwI YE3beDYUXRA3dhl/YmsnyA0fdvPgoUUerzKd5sDEu2BSW98av6ffJ6/oV74/NF5FG4LE j70KlQ9ibCBBMOTYADdnpczfXLY36zvOROyF0z6KaZuzfwyHaomDdIjcZxHSm0FFUMk0 i+kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773338524; x=1773943324; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=JBA5MyXByYLA3zXXjx3wMlp0Yon7kVfdTygyQg8Lb4A=; b=nPR3duWkDW7BVpmTt4jgPjb9fqfZlVoxaMWx9fxfI6QyB2lgLtUltK/xnLlgpHOOoY L/4tknt/hKHEDHiPDSMk7A5mLPYpZvYTx0GL+h0/H1bUma1pVLcUt9YyZgjOEpwWVVof G7P4oVp9h5ml83Y9gQ8ubSq+q3AdoqocMJTzYrlpEgNGFzAzw/02e04PlbtAcMLr17m9 /3wrpGamjYlZbBraNmFoa6XZooUp/TKWBppavOuqZVoqg/ZlGkVuZc3zgJvCFv9Icg4A qXvuAK7tN/1EuwDrAb3ny4NkNQsv2/soHFqFSmisHmohCt9jZLy9/ZJQHYMn1O39ByOJ vxSA== X-Forwarded-Encrypted: i=1; AJvYcCWmVK9DvkWISXgYyXwPs+ij5a6TgnO50YPMd4ABHDJwkj/oGi5+V13+r8y71a4lBUfvFrwH3D5VBjf4l/A=@vger.kernel.org X-Gm-Message-State: AOJu0Yx9yU8HxnKCyGVPG2b4jtJaKhBPOxf7dE5VZOBT+8McwllbQeBA nDjgLmVx4YUxeA1DNjgMoiP7ntmO640sVKlhk6mnddiIvuw3NU8mZ26E X-Gm-Gg: ATEYQzySLSNEJ4VxXOerVnfQXLDNz94Tm19Tk9B4c43a5Laqo2FrpQ4lHiriMwwBerF fX7MfeDydvdBMuIgyF3sQzwRU6B88ffgsaAGhH3ZuT2bX+0/3jFukQ0akd+Jkp/1Q3bKLO6q6IT LxnuyqE9MGOyhQ6B4in4g7eMYOTuO4hDXuNgtOOmuV3W5W0JwRrok7w/m5fxtezw0tE1k5lP8ot Lnrau8ZolktvxoKVILEmooTgXEnPCGwith8NUdwcrwxQqZw80fDblZ8r0qF1bGFwOgVGU+m4eYP 67FYlO7Jc6V1X1CT4xfY9AUYyH7V89mAYZc9yWPlxsndy9dtlV3hTxUWCKnNtfN/YWupSwKWvRE 0cfMieWGU3bEW4jUnratGtKGjPYw/MCNCXLg9lveoR9OZcoeCGFSY8u5pF/aRf1Qet+1OQuoUhL TE/o7nLhmSkyf26T/4h02NRt1JXSJ1qTiKK8X++tDOe9yQG+ARzK2QXCr6MEdLaSEOduMhjP9ls 1W42M3U/z+j7GpNtw5lMy+AoXVBuUyxSHXozB2XddZzRBVdrXZPnoTHovgwHlt9xBo+HmGtGkOG +v8EFg2g5nk= X-Received: by 2002:a05:600c:548a:b0:485:4100:1eee with SMTP id 5b1f17b1804b1-4855670e7f9mr4553495e9.24.1773338523328; Thu, 12 Mar 2026 11:02:03 -0700 (PDT) Received: from mail.gmail.com (2a01cb0889497e00e621310b96d0fd4d.ipv6.abo.wanadoo.fr. [2a01:cb08:8949:7e00:e621:310b:96d0:fd4d]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48541acea11sm277041675e9.7.2026.03.12.11.02.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 12 Mar 2026 11:02:02 -0700 (PDT) Date: Thu, 12 Mar 2026 19:02:00 +0100 From: Paul Chaignon To: Yonghong Song Cc: xulang , bpf@vger.kernel.org, martin.lau@linux.dev, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, song@kernel.org, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, kaiyanm@hust.edu.cn, huyinhao@hust.edu.cn, dzm91@hust.edu.cn, kernel@uniontech.com, linux-kernel@vger.kernel.org Subject: Re: [PATCH bpf v1] bpf: Fix OOB in bpf_obj_memcpy for cgroup storage Message-ID: References: <204030CBF30066BE+20260312052525.1254217-1-xulang@uniontech.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Thu, Mar 12, 2026 at 09:41:40AM -0700, Yonghong Song wrote: > > > On 3/12/26 4:51 AM, Paul Chaignon wrote: > > On Thu, Mar 12, 2026 at 01:25:25PM +0800, xulang wrote: > > > From: Lang Xu > > > > > > An out-of-bounds read occurs when copying element from a > > > BPF_MAP_TYPE_CGROUP_STORAGE map to another map type with the same > > > value_size that is not 8-byte aligned. > > > > > > The issue happens when: > > > 1. A CGROUP_STORAGE map is created with value_size not aligned to > > > 8 bytes (e.g., 4 bytes) > > > 2. A HASH map is created with the same value_size (e.g., 4 bytes) > > > 3. Update element in 2 with data in 1 > > > > > > In the kernel, map elements are typically aligned to 8 bytes. However, > > > bpf_cgroup_storage_calculate_size() allocates storage based on the exact > > > value_size without alignment. When copy_map_value_long() is called, it > > > assumes all map values are 8-byte aligned and rounds up the copy size, > > > leading to a 4-byte out-of-bounds read from the cgroup storage buffer. > > > > > > This patch fixes the issue by ensuring cgroup storage allocates 8-byte > > > aligned buffers, matching the assumptions in copy_map_value_long(). > > I don't think this bug is specific to the CGROUP_STORAGE maps. Wouldn't > > it affect any copy from a non-percpu map into a percpu hashmap? The > > reproducer in [1] copies from a BPF_MAP_TYPE_CGROUP_STORAGE map to a > > BPF_MAP_TYPE_LRU_PERCPU_HASH map, but I suspect you'd hit the same bug > > if copying from BPF_MAP_TYPE_HASH into BPF_MAP_TYPE_PERCPU_HASH because > > for BPF_MAP_TYPE_HASH the value size is also not rounded up to a > > multiple of 8. > > The BPF_MAP_TYPE_HASH table have value size rounds up to 8. See: > > if (percpu) > htab->elem_size += sizeof(void *); > else > htab->elem_size += round_up(htab->map.value_size, 8); > > The same for array size. My bad, I looked at the _alloc_check and assumed any round_up would be reflected there :/ Given that: Acked-by: Paul Chaignon I also had a look at other map types and they all seem to round up to 8 or to not be susceptible to the oob copy (ex., queue & stack). The one for which I'm unsure is BPF_MAP_TYPE_*_CGROUP_STORAGE. It doesn't seem to round up to 8, but I'm unsure it could be used to reproduce the copy. On a related note, this is the sort of reproducer that would be good to add in https://github.com/google/syzkaller/tree/master/sys/linux/test because syzbot can easily learn from it and reach potentially similar bugs. > > > > > 1 - https://lore.kernel.org/all/14e6c70c.6c121.19c0399d948.Coremail.kaiyanm@hust.edu.cn/ > > > > > Fixes: b741f1630346 ("bpf: introduce per-cpu cgroup local storage") > > > Reported-by: Kaiyan Mei > > > Closes: https://lore.kernel.org/all/14e6c70c.6c121.19c0399d948.Coremail.kaiyanm@hust.edu.cn/ > > > Signed-off-by: Lang Xu > > > --- > > > kernel/bpf/local_storage.c | 7 +++---- > > > 1 file changed, 3 insertions(+), 4 deletions(-) > > > > > > diff --git a/kernel/bpf/local_storage.c b/kernel/bpf/local_storage.c > > > index 8fca0c64f7b1..54b32ba19194 100644 > > > --- a/kernel/bpf/local_storage.c > > > +++ b/kernel/bpf/local_storage.c > > > @@ -487,14 +487,13 @@ static size_t bpf_cgroup_storage_calculate_size(struct bpf_map *map, u32 *pages) > > > { > > > size_t size; > > > + size = round_up(map->value_size, 8); > > > if (cgroup_storage_type(map) == BPF_CGROUP_STORAGE_SHARED) { > > > - size = sizeof(struct bpf_storage_buffer) + map->value_size; > > > + size += sizeof(struct bpf_storage_buffer); > > > *pages = round_up(sizeof(struct bpf_cgroup_storage) + size, > > > PAGE_SIZE) >> PAGE_SHIFT; > > > } else { > > > - size = map->value_size; > > > - *pages = round_up(round_up(size, 8) * num_possible_cpus(), > > > - PAGE_SIZE) >> PAGE_SHIFT; > > > + *pages = round_up(size * num_possible_cpus(), PAGE_SIZE) >> PAGE_SHIFT; > > > } > > > return size; > > > -- > > > 2.51.0 > > > > > > >