* [PATCH] bpf: fix stackmap overflow check in __bpf_get_stackid()
@ 2025-07-29 9:19 Arnaud Lecomte
2025-07-29 16:21 ` Yonghong Song
0 siblings, 1 reply; 3+ messages in thread
From: Arnaud Lecomte @ 2025-07-29 9:19 UTC (permalink / raw)
To: song
Cc: jolsa, ast, daniel, andrii, martin.lau, eddyz87, yonghong.song,
john.fastabend, kpsingh, sdf, haoluo, bpf, linux-kernel,
syzbot+c9b724fbb41cf2538b7b, Arnaud Lecomte
Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid()
when copying stack trace data. The issue occurs when the perf trace
contains more stack entries than the stack map bucket can hold,
leading to an out-of-bounds write in the bucket's data array.
For build_id mode, we use sizeof(struct bpf_stack_build_id)
to determine capacity, and for normal mode we use sizeof(u64).
Reported-by: syzbot+c9b724fbb41cf2538b7b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b
Tested-by: syzbot+c9b724fbb41cf2538b7b@syzkaller.appspotmail.com
Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
---
kernel/bpf/stackmap.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 3615c06b7dfa..0f9f6e4b6fe9 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -230,7 +230,7 @@ static long __bpf_get_stackid(struct bpf_map *map,
struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map);
struct stack_map_bucket *bucket, *new_bucket, *old_bucket;
u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
- u32 hash, id, trace_nr, trace_len, i;
+ u32 hash, id, trace_nr, trace_len, i, max_depth;
bool user = flags & BPF_F_USER_STACK;
u64 *ips;
bool hash_matches;
@@ -241,6 +241,16 @@ static long __bpf_get_stackid(struct bpf_map *map,
trace_nr = trace->nr - skip;
trace_len = trace_nr * sizeof(u64);
+
+ /* Clamp the trace to max allowed depth */
+ if (stack_map_use_build_id(map))
+ max_depth = smap->map.value_size / sizeof(struct bpf_stack_build_id);
+ else
+ max_depth = smap->map.value_size / sizeof(u64);
+
+ if (trace_nr > max_depth)
+ trace_nr = max_depth;
+
ips = trace->ip + skip;
hash = jhash2((u32 *)ips, trace_len / sizeof(u32), 0);
id = hash & (smap->n_buckets - 1);
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] bpf: fix stackmap overflow check in __bpf_get_stackid()
2025-07-29 9:19 [PATCH] bpf: fix stackmap overflow check in __bpf_get_stackid() Arnaud Lecomte
@ 2025-07-29 16:21 ` Yonghong Song
2025-07-29 16:54 ` Arnaud Lecomte
0 siblings, 1 reply; 3+ messages in thread
From: Yonghong Song @ 2025-07-29 16:21 UTC (permalink / raw)
To: Arnaud Lecomte, song
Cc: jolsa, ast, daniel, andrii, martin.lau, eddyz87, john.fastabend,
kpsingh, sdf, haoluo, bpf, linux-kernel,
syzbot+c9b724fbb41cf2538b7b
On 7/29/25 2:19 AM, Arnaud Lecomte wrote:
> Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid()
> when copying stack trace data. The issue occurs when the perf trace
> contains more stack entries than the stack map bucket can hold,
> leading to an out-of-bounds write in the bucket's data array.
> For build_id mode, we use sizeof(struct bpf_stack_build_id)
> to determine capacity, and for normal mode we use sizeof(u64).
>
> Reported-by: syzbot+c9b724fbb41cf2538b7b@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b
> Tested-by: syzbot+c9b724fbb41cf2538b7b@syzkaller.appspotmail.com
> Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
> ---
> kernel/bpf/stackmap.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
> index 3615c06b7dfa..0f9f6e4b6fe9 100644
> --- a/kernel/bpf/stackmap.c
> +++ b/kernel/bpf/stackmap.c
> @@ -230,7 +230,7 @@ static long __bpf_get_stackid(struct bpf_map *map,
> struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map);
> struct stack_map_bucket *bucket, *new_bucket, *old_bucket;
> u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
> - u32 hash, id, trace_nr, trace_len, i;
> + u32 hash, id, trace_nr, trace_len, i, max_depth;
> bool user = flags & BPF_F_USER_STACK;
> u64 *ips;
> bool hash_matches;
> @@ -241,6 +241,16 @@ static long __bpf_get_stackid(struct bpf_map *map,
>
> trace_nr = trace->nr - skip;
> trace_len = trace_nr * sizeof(u64);
> +
> + /* Clamp the trace to max allowed depth */
> + if (stack_map_use_build_id(map))
> + max_depth = smap->map.value_size / sizeof(struct bpf_stack_build_id);
> + else
> + max_depth = smap->map.value_size / sizeof(u64);
Replace the above with
max_depth = smap->map.value_size / stack_map_data_size(map)
?
> +
> + if (trace_nr > max_depth)
> + trace_nr = max_depth;
> +
> ips = trace->ip + skip;
> hash = jhash2((u32 *)ips, trace_len / sizeof(u32), 0);
> id = hash & (smap->n_buckets - 1);
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] bpf: fix stackmap overflow check in __bpf_get_stackid()
2025-07-29 16:21 ` Yonghong Song
@ 2025-07-29 16:54 ` Arnaud Lecomte
0 siblings, 0 replies; 3+ messages in thread
From: Arnaud Lecomte @ 2025-07-29 16:54 UTC (permalink / raw)
To: Yonghong Song, song
Cc: jolsa, ast, daniel, andrii, martin.lau, eddyz87, john.fastabend,
kpsingh, sdf, haoluo, bpf, linux-kernel,
syzbot+c9b724fbb41cf2538b7b
Good catch thanks Yonghong, sending rev2.
On 29/07/2025 17:21, Yonghong Song wrote:
>
>
> On 7/29/25 2:19 AM, Arnaud Lecomte wrote:
>> Syzkaller reported a KASAN slab-out-of-bounds write in
>> __bpf_get_stackid()
>> when copying stack trace data. The issue occurs when the perf trace
>> contains more stack entries than the stack map bucket can hold,
>> leading to an out-of-bounds write in the bucket's data array.
>> For build_id mode, we use sizeof(struct bpf_stack_build_id)
>> to determine capacity, and for normal mode we use sizeof(u64).
>>
>> Reported-by: syzbot+c9b724fbb41cf2538b7b@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b
>> Tested-by: syzbot+c9b724fbb41cf2538b7b@syzkaller.appspotmail.com
>> Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
>> ---
>> kernel/bpf/stackmap.c | 12 +++++++++++-
>> 1 file changed, 11 insertions(+), 1 deletion(-)
>>
>> diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
>> index 3615c06b7dfa..0f9f6e4b6fe9 100644
>> --- a/kernel/bpf/stackmap.c
>> +++ b/kernel/bpf/stackmap.c
>> @@ -230,7 +230,7 @@ static long __bpf_get_stackid(struct bpf_map *map,
>> struct bpf_stack_map *smap = container_of(map, struct
>> bpf_stack_map, map);
>> struct stack_map_bucket *bucket, *new_bucket, *old_bucket;
>> u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
>> - u32 hash, id, trace_nr, trace_len, i;
>> + u32 hash, id, trace_nr, trace_len, i, max_depth;
>> bool user = flags & BPF_F_USER_STACK;
>> u64 *ips;
>> bool hash_matches;
>> @@ -241,6 +241,16 @@ static long __bpf_get_stackid(struct bpf_map *map,
>> trace_nr = trace->nr - skip;
>> trace_len = trace_nr * sizeof(u64);
>> +
>> + /* Clamp the trace to max allowed depth */
>> + if (stack_map_use_build_id(map))
>> + max_depth = smap->map.value_size / sizeof(struct
>> bpf_stack_build_id);
>> + else
>> + max_depth = smap->map.value_size / sizeof(u64);
>
> Replace the above with
> max_depth = smap->map.value_size / stack_map_data_size(map)
> ?
>
>> +
>> + if (trace_nr > max_depth)
>> + trace_nr = max_depth;
>> +
>> ips = trace->ip + skip;
>> hash = jhash2((u32 *)ips, trace_len / sizeof(u32), 0);
>> id = hash & (smap->n_buckets - 1);
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-07-29 16:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-07-29 9:19 [PATCH] bpf: fix stackmap overflow check in __bpf_get_stackid() Arnaud Lecomte
2025-07-29 16:21 ` Yonghong Song
2025-07-29 16:54 ` Arnaud Lecomte
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®