[PATCH bpf] bpf: Zero-fill non-target CPU slots on BPF_F_CPU insert of new per-CPU element

[PATCH bpf] bpf: Zero-fill non-target CPU slots on BPF_F_CPU insert of new per-CPU element

[Ömer Mete Kaya]

pcpu_copy_value() with BPF_F_CPU copies the value only to the target
CPU's slot and returns immediately, leaving all other CPUs untouched.
When inserting a *new* element, the backing per-CPU area may be reused
from bpf_mem_cache or a prealloc freelist without being zero-initialized,
so non-target CPUs retain stale contents of a previously-deleted
element in the same map — a same-map information disclosure.

pcpu_init_value() is used to initialize newly allocated elements, while
updates to existing elements call pcpu_copy_value() directly; non-target
CPU slots intentionally retain their previous values there.

The onallcpus=false path in pcpu_init_value() already handles new
element initialization correctly by explicitly zeroing non-current CPUs:

  if (cpu == current_cpu)
      copy_map_value(..., value);
  else
      zero_map_value(...);

Fix by adding a zero-fill pass in pcpu_init_value() after
pcpu_copy_value() returns, covering only the BPF_F_CPU new-element
path: iterate all CPUs and zero-fill every slot except the target.
This leaves pcpu_copy_value() unchanged so the update-existing-element
semantics are not affected.

Fixes: c6936161fd55 ("bpf: Add BPF_F_CPU and BPF_F_ALL_CPUS flags support for percpu_hash and lru_percpu_hash maps")
Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
---
Tested with a reproducer:
- Before the fix: CPU 1 retained 0xDEADBEEFCAFEBABE from the deleted
  element.
- After the fix: the non-target CPU read back zero.

 kernel/bpf/hashtab.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 8cc07e54daaa..dff4321f2828 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -1099,6 +1099,16 @@ static void pcpu_init_value(struct bpf_htab *htab, void __percpu *pptr,
 		}
 	} else {
 		pcpu_copy_value(htab, pptr, value, onallcpus, map_flags);
+		if (map_flags & BPF_F_CPU) {
+			int target = map_flags >> 32;
+			int cpu;
+
+			for_each_possible_cpu(cpu) {
+				if (cpu != target)
+					zero_map_value(&htab->map,
+						       per_cpu_ptr(pptr, cpu));
+			}
+		}
 	}
 }

--
2.55.0