Re: [PATCH bpf] bpf: fix percpu map update indexing with sparse CPU IDs

[bot+bpf-ci@kernel.org]

[-- Attachment #1: Type: text/plain, Size: 2380 bytes --]

> commit 3563498ad027820b11bad3993a5c6a17d293ad23
> Author: Hui Su <sh_def@163.com>
>
>     bpf: fix percpu map update indexing with sparse CPU IDs
>
>     Per-CPU array, hash, and cgroup storage map updates without BPF_F_CPU
>     or BPF_F_ALL_CPUS use a value buffer whose per-CPU slots are packed in
>     possible-CPU order. The buffer is sized as:
>
>       round_up(value_size, 8) * num_possible_cpus()
>
>     The update paths iterate over possible CPUs, but use the logical CPU ID
>     to calculate the source offset:
>
>       value + size * cpu
>
>     This only works when possible CPU IDs are contiguous starting at zero.
>
>     For example, with a possible CPU mask of 0,2-3, the buffer contains
>     three slots corresponding to CPUs 0, 2, and 3. CPU2 is therefore
>     expected to use slot 1 and CPU3 slot 2. Instead, the current code uses
>     slots 2 and 3 respectively, causing incorrect per-CPU values and an
>     out-of-bounds read from the update buffer for CPU3.
>
>     The corresponding lookup paths already use a dense offset while
>     iterating over possible CPUs. Do the same for the array, hash, and
>     cgroup storage update paths, advancing the source offset once for each
>     possible CPU. BPF_F_ALL_CPUS continues to use the same value for every
>     CPU.
>
>     Fixes: 8eb76cb03f0f ("bpf: Add BPF_F_CPU and BPF_F_ALL_CPUS flags support for percpu_array maps")

The Fixes: tag points to 8eb76cb03f0f, which introduced the 'value +
size * cpu' pattern in bpf_percpu_array_update() (kernel/bpf/arraymap.c).
That attribution is correct for the arraymap.c fix.

However, at commit 8eb76cb03f0f, kernel/bpf/hashtab.c and
kernel/bpf/local_storage.c still used the correct 'off += size' pattern
and did not have the 'size * cpu' bug yet. The hashtab.c and
local_storage.c bugs were introduced later in the same BPF_F_CPU feature
series.

Should this commit include additional Fixes: tags for the commits that
introduced the bug in hashtab.c and local_storage.c? This would ensure
that backporting tools pick up all three fixes even when the percpu_array
commit is not present in a given stable tree.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31703563365