From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f175.google.com (mail-dy1-f175.google.com [74.125.82.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F2D9A3749EF for ; Tue, 9 Jun 2026 19:39:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781033966; cv=none; b=m9iXrnjMU4IbXgDR9VsDyWajHhEQfRQdRtvDS7N4svyLkARymbLkIU8K4DLixeIye74Cfw/Z8r1lBcmya18oJFe1C3busJH0NiS+W1bWkSjI91n6dEMe/5CYPLJdBM7XTqZzYY6txeeVtBw82ZJF8VUJ+3G50EURyWuTqJPJN+U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781033966; c=relaxed/simple; bh=G00YHjqP3bT3ws7OX9mlgD6sNkuOI5ON+qLPcjzJ5rc=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=jouKqxLQgWqtwZ0y5dvC24gscyC+2E7h48SyAbuHbGrInoXC0FMoK46w7c9KlfWnDNLuyxjIOvTq3/EatxG/8glVftwjJnU88LDsMjej9REE06f4vQfIp5qyiQEWMsCIFcY8a4V6Ug+GgFb6WTrniK/sQccGlRlFurhdn4GLf6c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=multikernel.io; spf=pass smtp.mailfrom=multikernel.io; dkim=pass (2048-bit key) header.d=multikernel-io.20251104.gappssmtp.com header.i=@multikernel-io.20251104.gappssmtp.com header.b=fXMzF7Hs; arc=none smtp.client-ip=74.125.82.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=multikernel.io Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=multikernel.io Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=multikernel-io.20251104.gappssmtp.com header.i=@multikernel-io.20251104.gappssmtp.com header.b="fXMzF7Hs" Received: by mail-dy1-f175.google.com with SMTP id 5a478bee46e88-304f0039c02so10666123eec.1 for ; Tue, 09 Jun 2026 12:39:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=multikernel-io.20251104.gappssmtp.com; s=20251104; t=1781033964; x=1781638764; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=mP79Pj+AGA3xIgjnkm3qbd2XZJduzfsdCp0zY5QTkXo=; b=fXMzF7Hsklq5g5iDJQvb/f+YOtr7R5Q1Ux24mulhEhddXRwK2/UXyS+tD09DRgCrij CanzmhEX/OubFqwGk/gYwxPqSiH1ibeA79/wEPw9Y1thtLsurO9YXocaDiU/1esslKh8 SKoAVwYEKaYw/W8ev/tRvpnlimp6aW9pQF8Br88GChuFz5kBp1taJ6iKEZqdsCGWMndU 7DLVBsUMzc0zu0n7FmDsPMLStaTP8s6t1ZqZLwMpvukdVPrgWJg81uqW7AsC75x/iZcF N8CPVbNoXfb/PXGVBtZK63zb8PnN/2LiOrgbCmvGxeXGxFni3n+3oWAtAXIcR4XeU3vG zR4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781033964; x=1781638764; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mP79Pj+AGA3xIgjnkm3qbd2XZJduzfsdCp0zY5QTkXo=; b=leIyU2EQ/riwhtKyrTVcycUEUFoKjAsTfJY68RbSlF+h6Y9heQz8h+V0GQfWuYFl0L oQLFc77ScGTq1a94/6SpDOCi9hzBxsu8xaLCZh/vPZKwIFfFnImdgCwMCEqjA3e2ixYq Vh70je3bdsURag6+H6wcokfA2aWTGO22OGPDiDoQecD5crj5S9yYocxX0kjwStwOUioP mKzS532Y8CcnDcT70HVzzunwjRXUUZKZSxeCX8wF71XfUpVrJZbyl0SYw+uziVpEvgJn x6YUzxD/96UnxOLNgrR5yor0eoRhgzDKmAZ7n4MTvdqPIZxEWIVvj1K99ZdJpVKbVFqw qdZQ== X-Forwarded-Encrypted: i=1; AFNElJ9ALeft26BYZX4FOz3DeTpFk6GWX5plFEFBVAHyxIgwPVOWvESFa+9UcLluFUzrMGa7k41/Ux0ouBEqjZg=@vger.kernel.org X-Gm-Message-State: AOJu0Yz9L1Yo25g3v9NByPD4rZJYsHmMVaWiHl5Ick6TC/PWioIuAMC+ YPioMTpqMh3IVxHX/Yl60Gxo0Ml4Zqa//Wk0FfUnsdWsRy9hmGC4TjHQIHZ2AGrP4jE= X-Gm-Gg: Acq92OHFQ514s9oS40OVa+x83+WapYvM/N2pBtobum1Qzywe17monFx48Kv8z4W/EmB aH9Q6Ss53TapuwzrtyeF8V1RSd8D9B5XPTJj622AqSkxu+0Wf3lnKEDOYX2N+uu28E0SEfUnfAR 1SQ6JXI0c1Iacddghmu0rjIF9Ni8ssx4NMc5oONOWPN2+MsjHLL/+gfbE94u7+w61yV2uIw+DB+ hFKY61mGe1SntxNs8FdkoRfl7NYVpFpNLkioE8kqo1/uPiZvAtD0mnG6WwPT2X3sgcXx0AVR8yf pqH7jGU+Gz3GFzrtGPtU1ZjjqmVINfo+Glv/sUnXYHHk8vglydlWQ1DkbMRwO+mRQ1Dt//8XavJ FIE2EmYfOycqahdELDotRgvEOytueaxzk8AvkPD0thjaWZjOgfvxgTNjMfDmAb456uHOhf2bCID CQO+ArnSxIyr8cpRi51CkE8WOuj7nWoHlo1s8vTEem2iDuT9d7LTTZkCs9OK/acmWCZwU= X-Received: by 2002:a05:7300:7493:b0:2e7:c701:aa85 with SMTP id 5a478bee46e88-307d62db622mr3709830eec.17.1781033963904; Tue, 09 Jun 2026 12:39:23 -0700 (PDT) Received: from localhost ([2601:647:6802:dbc0:cc9d:48e6:8d05:b444]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3074db56697sm23177016eec.2.2026.06.09.12.39.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Jun 2026 12:39:23 -0700 (PDT) Date: Tue, 9 Jun 2026 12:39:22 -0700 From: Cong Wang To: Sechang Lim Cc: Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Stanislav Fomichev , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , Zijian Zhang , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , bpf@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH bpf] bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check Message-ID: References: <20260609183927.4021802-1-rhkrqnwk98@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260609183927.4021802-1-rhkrqnwk98@gmail.com> On Tue, Jun 09, 2026 at 06:39:26PM +0000, Sechang Lim wrote: > start and len are u32, so > > u64 last = start + len; > > evaluates start + len in 32-bit and wraps before storing it in last. > The bounds check > > if (start >= offset + l || last > msg->sg.size) > return -EINVAL; > > can then be passed with an out-of-range start/len, after which the pop > loop runs off the end of the scatterlist and sk_msg_shift_left() calls > put_page() on the empty msg->sg.end slot: > > Oops: general protection fault, probably for non-canonical address > 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI > KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] > RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline] > RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline] > RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984 > Call Trace: > > bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8 > bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746 > sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934 > tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline] > tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583 > __sock_sendmsg+0x153/0x1c0 net/socket.c:802 > __sys_sendto+0x326/0x430 net/socket.c:2265 > __x64_sys_sendto+0xe3/0x100 net/socket.c:2268 > do_syscall_64+0x14c/0x480 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > If you have a reproducer, please consider adding a selftest either together this patch or as a follow-up. Thanks, Cong