* Forwarded: [PATCH] bpf: Fix double offset in check_reg_const_str()
2026-01-05 14:11 [syzbot] [bpf?] KASAN: slab-out-of-bounds Read in strnchr syzbot
@ 2026-01-06 4:48 ` syzbot
2026-01-06 5:19 ` Forwarded: [PATCH] bpf: Fix double offset in insn_array_map_direct_value_addr() syzbot
` (3 subsequent siblings)
4 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-01-06 4:48 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] bpf: Fix double offset in check_reg_const_str()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git master
map_direct_value_addr() returns the address already offset by map_off,
but check_reg_const_str() adds map_off again when calling strnchr().
This causes the null-termination check to read from the wrong address,
potentially past the end of the map value buffer.
This triggers a KASAN slab-out-of-bounds in strnchr() when a BPF program
passes a PTR_TO_MAP_VALUE to a helper expecting ARG_PTR_TO_CONST_STR,
as the verifier fails to properly validate the string is null-terminated
within bounds.
Remove the redundant offset addition since map_addr already points to
the correct location.
Reported-by: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com
Fixes: 0b51940729150 ("bpf: Factor out helper check_reg_const_str()")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
kernel/bpf/verifier.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index f0ca69f888fa..b1cb501fb577 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9638,7 +9638,7 @@ static int check_reg_const_str(struct bpf_verifier_env *env,
}
str_ptr = (char *)(long)(map_addr);
- if (!strnchr(str_ptr + map_off, map->value_size - map_off, 0)) {
+ if (!strnchr(str_ptr, map->value_size - map_off, 0)) {
verbose(env, "string is not zero-terminated\n");
return -EINVAL;
}
--
2.43.0
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: [PATCH] bpf: Fix double offset in insn_array_map_direct_value_addr()
2026-01-05 14:11 [syzbot] [bpf?] KASAN: slab-out-of-bounds Read in strnchr syzbot
2026-01-06 4:48 ` Forwarded: [PATCH] bpf: Fix double offset in check_reg_const_str() syzbot
@ 2026-01-06 5:19 ` syzbot
2026-01-06 15:44 ` Forwarded: [PATCH] bpf: Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str() syzbot
` (2 subsequent siblings)
4 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-01-06 5:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] bpf: Fix double offset in insn_array_map_direct_value_addr()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git master
insn_array_map_direct_value_addr() adds the offset to the returned
address, but callers of map_direct_value_addr() expect the base address
and add the offset themselves. This is inconsistent with other
implementations like array_map_direct_value_addr() and
arena_map_direct_value_addr() which return only the base address.
This causes a double offset when check_reg_const_str() validates
ARG_PTR_TO_CONST_STR arguments, leading to an out-of-bounds read
in strnchr() when bpf_snprintf() is called with a format string
from an insn_array map.
Remove the offset addition to match the expected behavior.
Reported-by: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
kernel/bpf/bpf_insn_array.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/bpf_insn_array.c b/kernel/bpf/bpf_insn_array.c
index c96630cb75bf..37b43102953e 100644
--- a/kernel/bpf/bpf_insn_array.c
+++ b/kernel/bpf/bpf_insn_array.c
@@ -126,7 +126,7 @@ static int insn_array_map_direct_value_addr(const struct bpf_map *map, u64 *imm,
return -EINVAL;
/* from BPF's point of view, this map is a jump table */
- *imm = (unsigned long)insn_array->ips + off;
+ *imm = (unsigned long)insn_array->ips;
return 0;
}
--
2.43.0
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: [PATCH] bpf: Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str()
2026-01-05 14:11 [syzbot] [bpf?] KASAN: slab-out-of-bounds Read in strnchr syzbot
2026-01-06 4:48 ` Forwarded: [PATCH] bpf: Fix double offset in check_reg_const_str() syzbot
2026-01-06 5:19 ` Forwarded: [PATCH] bpf: Fix double offset in insn_array_map_direct_value_addr() syzbot
@ 2026-01-06 15:44 ` syzbot
2026-01-07 8:47 ` [syzbot] [bpf?] KASAN: slab-out-of-bounds Read in strnchr Edward Adam Davis
2026-01-07 9:39 ` [PATCH] bpf: Format string can't be empty Edward Adam Davis
4 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-01-06 15:44 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] bpf: Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git master
BPF_MAP_TYPE_INSN_ARRAY maps store instruction pointers in their
ips array, not string data. The map_direct_value_addr callback for
this map type returns the address of the ips array, which is not
suitable for use as a constant string argument.
When a BPF program passes a pointer to an insn_array map value as
ARG_PTR_TO_CONST_STR (e.g., to bpf_snprintf), the verifier's
null-termination check in check_reg_const_str() operates on the
wrong memory region, and at runtime bpf_bprintf_prepare() can read
out of bounds searching for a null terminator.
Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str() since this
map type is not designed to hold string data.
Reported-by: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
kernel/bpf/verifier.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index f0ca69f888fa..3135643d5695 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9609,6 +9609,11 @@ static int check_reg_const_str(struct bpf_verifier_env *env,
if (reg->type != PTR_TO_MAP_VALUE)
return -EINVAL;
+ if (map->map_type == BPF_MAP_TYPE_INSN_ARRAY) {
+ verbose(env, "R%d points to insn_array map which cannot be used as const string\n", regno);
+ return -EACCES;
+ }
+
if (!bpf_map_is_rdonly(map)) {
verbose(env, "R%d does not point to a readonly map'\n", regno);
return -EACCES;
--
2.43.0
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [syzbot] [bpf?] KASAN: slab-out-of-bounds Read in strnchr
2026-01-05 14:11 [syzbot] [bpf?] KASAN: slab-out-of-bounds Read in strnchr syzbot
` (2 preceding siblings ...)
2026-01-06 15:44 ` Forwarded: [PATCH] bpf: Reject BPF_MAP_TYPE_INSN_ARRAY in check_reg_const_str() syzbot
@ 2026-01-07 8:47 ` Edward Adam Davis
2026-01-07 9:39 ` syzbot
2026-01-07 9:39 ` [PATCH] bpf: Format string can't be empty Edward Adam Davis
4 siblings, 1 reply; 10+ messages in thread
From: Edward Adam Davis @ 2026-01-07 8:47 UTC (permalink / raw)
To: syzbot+2c29addf92581b410079; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index db72b96f9c8c..88da2d0e634c 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -827,7 +827,7 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";
fmt_end = strnchr(fmt, fmt_size, 0);
- if (!fmt_end)
+ if (!fmt_end || fmt_end == fmt)
return -EINVAL;
fmt_size = fmt_end - fmt;
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH] bpf: Format string can't be empty
2026-01-05 14:11 [syzbot] [bpf?] KASAN: slab-out-of-bounds Read in strnchr syzbot
` (3 preceding siblings ...)
2026-01-07 8:47 ` [syzbot] [bpf?] KASAN: slab-out-of-bounds Read in strnchr Edward Adam Davis
@ 2026-01-07 9:39 ` Edward Adam Davis
2026-01-08 3:02 ` Alexei Starovoitov
4 siblings, 1 reply; 10+ messages in thread
From: Edward Adam Davis @ 2026-01-07 9:39 UTC (permalink / raw)
To: syzbot+2c29addf92581b410079
Cc: andrii, ast, bpf, daniel, eddyz87, haoluo, john.fastabend, jolsa,
kpsingh, linux-kernel, martin.lau, netdev, sdf, song,
syzkaller-bugs, yonghong.song
The user constructed a BPF program containing a bpf_snprintf() call.
The fmt parameter passed to bpf_snprintf() was not assigned a value;
it only executed the BPF_MAP_FREEZE command to freeze the fmt string.
Furthermore, when bpf_check() executed check_reg_const_str() and
check_bpf_snprintf_call() to check the fmt input parameter of the
user-constructed BPF program's bpf_snprintf() call, strnchr() only
checked if fmt was a null-terminated string. This led the BPF verifier
to incorrectly assume the constant format string was valid.
When the BPF program was actually executed, the out-of-bounds (OOB)
issue reported by syzbot occurred [1].
This issue is strongly related to bpf_snprintf(), therefore adding a
check for an empty format string in check_bpf_snprintf_call() would
be beneficial. Since it calls bpf_bprintf_prepare(), only adding a
check on the result of strnchr() is needed to prevent the case where
the format string is empty.
[1]
BUG: KASAN: slab-out-of-bounds in strnchr+0x5e/0x80 lib/string.c:405
Read of size 1 at addr ffff888029e093b0 by task ksoftirqd/1/23
Call Trace:
strnchr+0x5e/0x80 lib/string.c:405
bpf_bprintf_prepare+0x167/0x13d0 kernel/bpf/helpers.c:829
____bpf_snprintf kernel/bpf/helpers.c:1065 [inline]
bpf_snprintf+0xd3/0x1b0 kernel/bpf/helpers.c:1049
Allocated by task 6022:
__bpf_map_area_alloc kernel/bpf/syscall.c:395 [inline]
bpf_map_area_alloc+0x64/0x180 kernel/bpf/syscall.c:408
insn_array_alloc+0x52/0x140 kernel/bpf/bpf_insn_array.c:49
map_create+0xafd/0x16a0 kernel/bpf/syscall.c:1514
The buggy address is located 0 bytes to the right of
allocated 944-byte region [ffff888029e09000, ffff888029e093b0)
Fixes: d9c9e4db186a ("bpf: Factorize bpf_trace_printk and bpf_seq_printf")
Reported-by: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2c29addf92581b410079
Tested-by: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
kernel/bpf/helpers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index db72b96f9c8c..88da2d0e634c 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -827,7 +827,7 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";
fmt_end = strnchr(fmt, fmt_size, 0);
- if (!fmt_end)
+ if (!fmt_end || fmt_end == fmt)
return -EINVAL;
fmt_size = fmt_end - fmt;
--
2.43.0
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH] bpf: Format string can't be empty
2026-01-07 9:39 ` [PATCH] bpf: Format string can't be empty Edward Adam Davis
@ 2026-01-08 3:02 ` Alexei Starovoitov
2026-01-08 3:52 ` Edward Adam Davis
0 siblings, 1 reply; 10+ messages in thread
From: Alexei Starovoitov @ 2026-01-08 3:02 UTC (permalink / raw)
To: Edward Adam Davis
Cc: syzbot+2c29addf92581b410079, Andrii Nakryiko, Alexei Starovoitov,
bpf, Daniel Borkmann, Eduard, Hao Luo, John Fastabend, Jiri Olsa,
KP Singh, LKML, Martin KaFai Lau, Network Development,
Stanislav Fomichev, Song Liu, syzkaller-bugs, Yonghong Song
On Wed, Jan 7, 2026 at 1:39 AM Edward Adam Davis <eadavis@qq.com> wrote:
>
> The user constructed a BPF program containing a bpf_snprintf() call.
> The fmt parameter passed to bpf_snprintf() was not assigned a value;
> it only executed the BPF_MAP_FREEZE command to freeze the fmt string.
> Furthermore, when bpf_check() executed check_reg_const_str() and
> check_bpf_snprintf_call() to check the fmt input parameter of the
> user-constructed BPF program's bpf_snprintf() call, strnchr() only
> checked if fmt was a null-terminated string. This led the BPF verifier
> to incorrectly assume the constant format string was valid.
> When the BPF program was actually executed, the out-of-bounds (OOB)
> issue reported by syzbot occurred [1].
>
> This issue is strongly related to bpf_snprintf(), therefore adding a
> check for an empty format string in check_bpf_snprintf_call() would
> be beneficial. Since it calls bpf_bprintf_prepare(), only adding a
> check on the result of strnchr() is needed to prevent the case where
> the format string is empty.
>
> [1]
> BUG: KASAN: slab-out-of-bounds in strnchr+0x5e/0x80 lib/string.c:405
> Read of size 1 at addr ffff888029e093b0 by task ksoftirqd/1/23
> Call Trace:
> strnchr+0x5e/0x80 lib/string.c:405
> bpf_bprintf_prepare+0x167/0x13d0 kernel/bpf/helpers.c:829
> ____bpf_snprintf kernel/bpf/helpers.c:1065 [inline]
> bpf_snprintf+0xd3/0x1b0 kernel/bpf/helpers.c:1049
>
> Allocated by task 6022:
> __bpf_map_area_alloc kernel/bpf/syscall.c:395 [inline]
> bpf_map_area_alloc+0x64/0x180 kernel/bpf/syscall.c:408
> insn_array_alloc+0x52/0x140 kernel/bpf/bpf_insn_array.c:49
> map_create+0xafd/0x16a0 kernel/bpf/syscall.c:1514
>
> The buggy address is located 0 bytes to the right of
> allocated 944-byte region [ffff888029e09000, ffff888029e093b0)
>
> Fixes: d9c9e4db186a ("bpf: Factorize bpf_trace_printk and bpf_seq_printf")
> Reported-by: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2c29addf92581b410079
> Tested-by: syzbot+2c29addf92581b410079@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
> kernel/bpf/helpers.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index db72b96f9c8c..88da2d0e634c 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -827,7 +827,7 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
> char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";
>
> fmt_end = strnchr(fmt, fmt_size, 0);
> - if (!fmt_end)
> + if (!fmt_end || fmt_end == fmt)
> return -EINVAL;
I don't think you root caused it correctly.
The better fix and analysis:
https://patchwork.kernel.org/project/netdevbpf/patch/20260107021037.289644-1-kartikey406@gmail.com/
pw-bot: cr
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH] bpf: Format string can't be empty
2026-01-08 3:02 ` Alexei Starovoitov
@ 2026-01-08 3:52 ` Edward Adam Davis
2026-01-08 21:43 ` Alexei Starovoitov
0 siblings, 1 reply; 10+ messages in thread
From: Edward Adam Davis @ 2026-01-08 3:52 UTC (permalink / raw)
To: alexei.starovoitov
Cc: andrii, ast, bpf, daniel, eadavis, eddyz87, haoluo,
john.fastabend, jolsa, kpsingh, linux-kernel, martin.lau, netdev,
sdf, song, syzbot+2c29addf92581b410079, syzkaller-bugs,
yonghong.song
On Wed, 7 Jan 2026 19:02:37 -0800, Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
> > diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> > index db72b96f9c8c..88da2d0e634c 100644
> > --- a/kernel/bpf/helpers.c
> > +++ b/kernel/bpf/helpers.c
> > @@ -827,7 +827,7 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
> > char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";
> >
> > fmt_end = strnchr(fmt, fmt_size, 0);
> > - if (!fmt_end)
> > + if (!fmt_end || fmt_end == fmt)
> > return -EINVAL;
>
> I don't think you root caused it correctly.
> The better fix and analysis:
I am keeping my analysis and patch.
The root cause of the problem is that the format string does not contain
a null terminator ('\0').
Filtering out map type 0x22 to solve the problem is too hasty, as it
would prevent all instructions from calling functions with constant
string arguments.
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH] bpf: Format string can't be empty
2026-01-08 3:52 ` Edward Adam Davis
@ 2026-01-08 21:43 ` Alexei Starovoitov
0 siblings, 0 replies; 10+ messages in thread
From: Alexei Starovoitov @ 2026-01-08 21:43 UTC (permalink / raw)
To: Edward Adam Davis
Cc: Andrii Nakryiko, Alexei Starovoitov, bpf, Daniel Borkmann,
Eduard, Hao Luo, John Fastabend, Jiri Olsa, KP Singh, LKML,
Martin KaFai Lau, Network Development, Stanislav Fomichev,
Song Liu, syzbot+2c29addf92581b410079, syzkaller-bugs,
Yonghong Song
On Wed, Jan 7, 2026 at 7:52 PM Edward Adam Davis <eadavis@qq.com> wrote:
>
> On Wed, 7 Jan 2026 19:02:37 -0800, Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
> > > diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> > > index db72b96f9c8c..88da2d0e634c 100644
> > > --- a/kernel/bpf/helpers.c
> > > +++ b/kernel/bpf/helpers.c
> > > @@ -827,7 +827,7 @@ int bpf_bprintf_prepare(const char *fmt, u32 fmt_size, const u64 *raw_args,
> > > char fmt_ptype, cur_ip[16], ip_spec[] = "%pXX";
> > >
> > > fmt_end = strnchr(fmt, fmt_size, 0);
> > > - if (!fmt_end)
> > > + if (!fmt_end || fmt_end == fmt)
> > > return -EINVAL;
> >
> > I don't think you root caused it correctly.
> > The better fix and analysis:
> I am keeping my analysis and patch.
> The root cause of the problem is that the format string does not contain
> a null terminator ('\0').
> Filtering out map type 0x22 to solve the problem is too hasty, as it
> would prevent all instructions from calling functions with constant
> string arguments.
If you think it's still possible to construct a program that
passes empty const string into this helper then please craft
a selftest that demonstrates that.
^ permalink raw reply [flat|nested] 10+ messages in thread