From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-187.mta1.migadu.com (out-187.mta1.migadu.com [95.215.58.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5205A32FA2C for ; Sat, 25 Apr 2026 02:55:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.187 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777085747; cv=none; b=a677GmXt48u2AH8PdYNBkRMqnKksv3qgpli4CfALmBWyK0q8nUStnijTczfOUeRTQtymVe6ulqFoC/fQuf52iIKdmOwdY226EExXfJnX0qjjHEIPzliVQhIFPyiFieMsQsPjRnW2jxS5tXa8YCwJz11aLXCIpy8RQFol55Whruk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777085747; c=relaxed/simple; bh=UmV3xv7xVf2Zo2jFtRDOFkdl/3JCz++nNgKfRcYOJ5k=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=u0K7fDcdFr8iYUvBMbmxsl4iRj858JeI6oIW04erDXq2iK5D3QKODLV79VNsEhttiuE6yTj5HrAqrM43qJpdRhO1OlhA9dM+B/DusEDdplF4SQ+cdWGEpJ3OeXG/rO2WC/b8qtgrChoXHGmwZSqkGbFKxRs+BO3RpZb0SE7r5Ww= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=XMnNM1St; arc=none smtp.client-ip=95.215.58.187 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="XMnNM1St" Message-ID: <11e4c78b-dd7b-44f7-800f-cf64517f4a1d@linux.dev> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1777085743; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wl0lrophzi3EeTmlvaWExT7+wFATN1EZSzwT4PC8Lwc=; b=XMnNM1StXu64hqnkN6CLPsSarr1RFd7ibE923zPbneYwRMvO6ER9FwL7GJ9sGGMNNjaEQs 8NICDG8y8nAjz+cwzSzAv5lzuMV+/VdPbdqy3bOTI+Pvsbs/EHyMQ09Otra+31IP+Zp4v/ Phx//PeVCgBrdoSrr40GRug94lvrAXM= Date: Sat, 25 Apr 2026 10:55:28 +0800 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [PATCH bpf] bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() To: Weiming Shi , Martin KaFai Lau , Daniel Borkmann , Alexei Starovoitov , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: John Fastabend , Stanislav Fomichev , Song Liu , Yonghong Song , Jiri Olsa , Simon Horman , bpf@vger.kernel.org, netdev@vger.kernel.org, Xiang Mei , Xinyu Ma References: <20260424191602.1522411-3-bestswngs@gmail.com> X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Jiayuan Chen In-Reply-To: <20260424191602.1522411-3-bestswngs@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Migadu-Flow: FLOW_OUT On 4/25/26 3:16 AM, Weiming Shi wrote: > When the scatterlist ring is full or nearly full, bpf_msg_push_data() > enters a copy fallback path and computes copy + len for the page > allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING > and both are u32, a crafted len can wrap the sum to a small value, > causing an undersized allocation followed by an out-of-bounds memcpy. > > BUG: unable to handle page fault for address: ffffed104089a402 > Oops: Oops: 0000 [#1] SMP KASAN NOPTI > Call Trace: > __asan_memcpy (mm/kasan/shadow.c:105) > bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788) > bpf_prog_9ed8b5711920a7d7+0x2e/0x36 > sk_psock_msg_verdict (net/core/skmsg.c:934) > tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584) > __sys_sendto (net/socket.c:2206) > do_syscall_64 (arch/x86/entry/syscall_64.c:94) > entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) > > Add an overflow check before the allocation. > > Link: https://lore.kernel.org/all/20260424155913.A19FDC19425@smtp.kernel.org > Fixes: 6fff607e2f14 ("bpf: sk_msg program helper bpf_msg_push_data") > Tested-by: Xiang Mei > Tested-by: Xinyu Ma > Signed-off-by: Weiming Shi Reviewed-by: Jiayuan Chen