From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 673943BB115 for ; Fri, 5 Jun 2026 01:56:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780624625; cv=none; b=jaj2YIeq9pyvDqtzTsYtho9jaRxIjObBwMqab+pPMg38FSf6ALHEAcABOvitr/MOivNTTpNtOKjNXSHto/WJSv2DaB60smFBykYohxudxEPgOT/3Cogx9lsznI6JhO1d7eNcw77VqbaoSoBOA4gkm3MvalCvQueRgvGKPBp1PoA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780624625; c=relaxed/simple; bh=jadmf9VC1LDUyEhkM6b+U+lNaW2DjPMJVqrBELeHNbs=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=IvcWg7DlGlO5uKb0mhd1fxNFMO5IrWp3+tYJlbCyUd9M6RuetJhws5ougoFYT5cQMN0NiBWcoOHWY9Sq/hk/mpMb0CC7I1EMWZijPLgQSyf2vT5Ai8oxPhGYgMBFq7ylDBaaGbv8ui9+ckbmUrSWGCWdMf2SS/PRT/6988RV1FE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YVvAkU6/; arc=none smtp.client-ip=209.85.216.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YVvAkU6/" Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-36dd65b95f2so968872a91.0 for ; Thu, 04 Jun 2026 18:56:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780624618; x=1781229418; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=r9fHnE5/aWcHmZBAbpBqPooAqFKln3As1ZY+Jwjk9ec=; b=YVvAkU6/xKVGEpkNZ/LsWpFaCRYcyKQS7WdojY+UBhjCVOnwjwJm0TMrhu29xV1Z+Q Kr7ZiSAe26bxM/9256JDsXPgzZ57cqbOGo3btDhkXeofw5x+Y9tr7hWC/DiSZRy2dCAA 3BHtDHJpMULM0WeZZ7GvPqd+LA8NTtDyez18z/mgZWTXWi3ZuxhHZFLT2c6mjumxsE8L hp/u99c5lqOclMyeBVpunZGHZPVvxabnLMT5MdXjlQmVXUusRFvG6g1cwXImig0CN4a3 xgojwQxCN+erWpquLN43kqk6r7Jpbm/jN9VMzpzSj/pilR/cchAzrnvyEVGCkCJmxQt2 GHaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780624618; x=1781229418; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=r9fHnE5/aWcHmZBAbpBqPooAqFKln3As1ZY+Jwjk9ec=; b=GR3Iu6ReCnTHK5QZRMRwY2VLLfDK0lb2/3Tbw7+W6BJuoSX3Y5oWbH3OcyhiB8/YSl 0kjKknKMBxbmzzA3PGXiKw+SutgTCXxJoonl4joCfJhgVyVoZdzjERNgmSPNlLb22vhk IvpcIwopWblCpvRa8MyI19XlHXqi62fX7MjWlMRZAqrIHGm0woKZ86o139BdlrcZ0R+/ gDLnesqJqEOnvPyGrgQ1cMogBaUWMjY/Kz1lbCP7EVQNgEmXpxseldHZxFj04Pdpv8EH w1sgMsjIHY+oW2m5/TzOeFO+oIBkcV8oFRgPtvBpVCQafBopvp0F5cgCbhAyl26IHXW7 X8JA== X-Forwarded-Encrypted: i=1; AFNElJ+JwwCZyFlfm1cNRz9Mb07MHlQErVrcuE7wgag47JCtNZfSbgMK95HF1Tiv68BGe1BfnnV8ibPBRE52ioY=@vger.kernel.org X-Gm-Message-State: AOJu0Yw89IbQOcH8Sv6Obd7RvlEu3s/bOeNKCOSNUW+CaVSIqwwy1dEA Q8VXOCo6z2VqC7Mf0eA0WoFKPwdennhBx1iUXvbS7jcoykQ1saxzu+3i X-Gm-Gg: Acq92OEnjiLyn1iOeWm4JKTwuMy2I5qTM2VQMBo3AbRR3S23XHoOt6IrLDVpw3Yq4T2 UtBkXAA4RNL/umRJIoaCYLOEA5wJ8N0k9ZyEU7EvL5z1TGf/HDw7f24wq06u8PIOnIwCIqfTuko QKY9iAcT+nk7rcd9XX/aLY//VTvLQQHQVIuv85d7Jj/LC4NfQbP6/GACtbQsI9wO+4Ntp0+V6VT Lep1pSfuoVafFnjAPQiavEhcIojVXu1MHtaGhibW3N2vYHECtDBucnX2n4afQ/rx9vhFkAj0YMT BbCxo6nM+8hb4AHadQGQRhZWEPJCeT0iCoXHRCrHEC5a1NrGr5BRoKd5enemMKUs1J+bRdEfszI NEk4/WsJpNoBEk3T77bl91wPo34VKTPLVcz86J42kX8odmeHxRkizldqxosTpPSQ81u4sz/OHsj D22d+yG21M8S3y65BunfIMOmXThMk+SmYDZE5GE0JGhPrt2qjkDqADgg== X-Received: by 2002:a17:90b:2f0d:b0:368:3830:a8bd with SMTP id 98e67ed59e1d1-37131041514mr487063a91.7.1780624618384; Thu, 04 Jun 2026 18:56:58 -0700 (PDT) Received: from [10.22.65.66] ([118.201.124.118]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36f6bf827f1sm5711912a91.3.2026.06.04.18.56.52 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 04 Jun 2026 18:56:57 -0700 (PDT) Message-ID: Date: Fri, 5 Jun 2026 09:56:50 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH bpf-next v2 1/3] bpf: Check tail zero of bpf_map_info Content-Language: en-US To: Alexei Starovoitov , bot+bpf-ci@kernel.org Cc: bpf , Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Martin KaFai Lau , Eduard , Kumar Kartikeya Dwivedi , Song Liu , Yonghong Song , Jiri Olsa , Shuah Khan , Yuyang Huang , KP Singh , Dave Marchevsky , Stanislav Fomichev , LKML , "open list:KERNEL SELFTEST FRAMEWORK" , kernel-patches-bot@fb.com, Mykyta Yatsenko , Martin KaFai Lau , Chris Mason , Ihor Solodrai References: <20260604150505.99129-2-leon.hwang@linux.dev> <3e8f405c266d6f15cc2ffeb3ffbe3674b19633c43048c1942e9a33db86c4c811@mail.kernel.org> From: Leon Hwang In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On 5/6/26 00:39, Alexei Starovoitov wrote: > On Thu, Jun 4, 2026 at 8:45 AM wrote: >> >>> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c >>> index 625a4366fe6d..1007fb7c87e9 100644 >>> --- a/kernel/bpf/syscall.c >>> +++ b/kernel/bpf/syscall.c >>> @@ -5400,10 +5400,11 @@ static int bpf_map_get_info_by_fd(struct file *file, >>> { >>> struct bpf_map_info __user *uinfo = u64_to_user_ptr(attr->info.info); >>> struct bpf_map_info info; >>> - u32 info_len = attr->info.info_len; >>> + u32 info_len = attr->info.info_len, len; >>> int err; >>> >>> - err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), sizeof(info), info_len); >>> + len = offsetofend(struct bpf_map_info, hash_size); >>> + err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), len, info_len); >> >> Does this change break the ABI for existing deployed binaries? Previously, >> expected_size was 104 (sizeof(info)). If an existing binary passes info_len >> = 104 with uninitialized stack garbage in the 4-byte padding, >> bpf_check_uarg_tail_zero() would see actual_size <= expected_size (104 <= >> 104) and immediately return 0. >> >> By reducing expected_size to 100, actual_size > expected_size (104 > 100), >> so bpf_check_uarg_tail_zero() will actively check the 4 padding bytes and >> return -E2BIG if they contain garbage. This rejects previously working >> applications. >> >> Additionally, does this actually protect against the stated future issue? >> If a future kernel adds a new 4-byte field, the struct size stays 104, and >> the new kernel's expected_size will be 104. At that point, those old buggy >> binaries passing info_len = 104 will once again hit the fast path >> (actual_size <= expected_size), skipping the check and allowing the >> uninitialized padding to be consumed as the new field. > > bot's concerns are valid. > Let's add __u32 :32 to bpf_map_info at the same time. > Will add it. Thanks, Leon