From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f170.google.com (mail-pf1-f170.google.com [209.85.210.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EFC6C325706 for ; Thu, 25 Jun 2026 20:34:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782419679; cv=none; b=EKiMww4SuTbCdv/fNkrQyiiv8v6KrQE5tRjg/oTKcSLPBqLwnBPNe8sSpRb9Bwk7EEm+JAtwoCDRr/+WqD66+IURxmbXPElO2/e+z2PBKIBKblVatvXeAu8XLbpvHrRF60ItsW9+2EACfhxVD3sV9/n//FE7XzfeAzMekR73JG8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782419679; c=relaxed/simple; bh=jvefDCupa63B7z6ewc8630KRIlgmUwgjGlbSSSzOvhw=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=iXdl1xnBapbujXxe4zj4nh8Xx6xUFz48BaCLzmPBLNIn9dx3p2kdvzaQUw69RWnd/U2ZxAO/C6Eqp79Uyt7wf4P8r+NeZNjN3uXKqTuFBGA51KvegGHmRfTgo17gNC4eMHzfYKyNC2wWv6h2JALOmvYT3bQspL5av+gnS5ZxAFE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Q2ZBfBby; arc=none smtp.client-ip=209.85.210.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Q2ZBfBby" Received: by mail-pf1-f170.google.com with SMTP id d2e1a72fcca58-84594492c26so133299b3a.2 for ; Thu, 25 Jun 2026 13:34:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782419676; x=1783024476; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=j4cziRsnOXU8udnzmTxz4VvnRIsHkxiDHnSiCu2+4Iw=; b=Q2ZBfBbyP1DHdbTQM2KQsipfzQ3jCbx1FckHKtvFCFs57R0u3DHVOIj5rlKswpUKmE EmQLfUQL9VmzKwe/zpd54DG2jlkBz2bUkLzaRxLuqGPYx6ebHNmcKrvKL0PdDIh+TIMG 5tfDyX76CJj8BUrvt6EX/+aLIjukAity0jpM1XCrN8fq1wdVlKW0+LYaCiwrliHyPJTc kP+yXMUNB6RlHPfTjGK0c0hnPKk21QWyxKwTdG47jKFw3BLkdejTmo16QG5c0bd/flFa xKW42k5cUxaPU2YzQE1kPGg3J/srKpHeQNU3zcZjhV7xyDynnGcn0hC9YiI/Hr1zSF2q TXTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782419676; x=1783024476; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=j4cziRsnOXU8udnzmTxz4VvnRIsHkxiDHnSiCu2+4Iw=; b=kJYdYNBU3iy3CA7x1H0k0BZfHanjzJY8wRIncFbzgaxMcXajDEqYTkpsx8VqLHbDCO ZZL2w73GeVaRwOlo5LfjL+62jHaFQg0fcwSMRP5McbcY9YiTVFD2NsrgKA6r0IiAv0HZ 6ccSCjPPz2AvCLKiC44p01Hz3MZt5KcGBklCM0B6XZDNT7ls4Bzlnmf2trw47NInlSlw SoV+qCkG0kp/1wp1H987EbklMT287BNC8TaK4IZEFCkMdcrBy3RXBBZ8Mes9lQZ5BMka /HEY7371FHwO/LpcLJvFGUfrtQHYUIqyTO02vmQl1wVbwUvk0Zh865ZlIAZzK/9JBMwe sA8A== X-Forwarded-Encrypted: i=1; AHgh+RoclP0kx6Iw5Vw8X6BJJl3BWsqM6atLzX764R3SWJ36zOH5ETAU2FhLGy4y1U07Iy3ZyJ/ouh6ZDSqpGwA=@vger.kernel.org X-Gm-Message-State: AOJu0YzxQQd78KGlIjbK37Eu3pmJFkLBE/wJS3atJUwz7+WxdHch8qyt GeZP0lhmtBrud6XfbJrFhWaBHUWK/Nn+eWVlLHvlM34q+s0AiKwsx4zH X-Gm-Gg: AfdE7cmFSyE6nTU2Y05fhcBbHv1+aivxxsThZcwHGwv5FiaBwTWQHXfKH28MjNlzvot g06vEFdmbiv3M1rO8EHBveiLUGgPux06trzpu0O/Xkj+doCEshtJkN1vazYWh2EXTlL8mP8CgB6 0XGuUWw4EBUxkPIbSejgvmk6uo4PMr2taAo+0/I4uh4lPCWl7apCcWGMMO95R2gSHiG9ZYG7Kx2 OWJgmARCWQHyB7jkQvNM1Pxqb2cI7YKoGQBqxCVYazf6YSHJEE6t/8KRUqMKC72S9wSO09nNaiI iUWsh2XkbAZ/ERtwSXuR0bgfCSIx0jw9u+UubDPdkZ8fv5pAZdvCpOv0/r8IG68acE/XFkhCipG xzIBsbj3Xm1hyObPw4tPLifU4tdELhNcMssktDESlKEYL4RzxjwbKmVtV7aExi4WsfIlggErjQy 0G6xr0+2xHcP9j92ghtJoJq+YxUp75Snm+5vSiNkTzow== X-Received: by 2002:a05:6a00:b81:b0:842:7f81:8085 with SMTP id d2e1a72fcca58-845b39969a1mr5178575b3a.8.1782419676054; Thu, 25 Jun 2026 13:34:36 -0700 (PDT) Received: from [192.168.0.226] ([38.34.87.7]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-845ba19f72bsm1607019b3a.20.2026.06.25.13.34.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jun 2026 13:34:35 -0700 (PDT) Message-ID: Subject: Re: [PATCH bpf-next v2 1/2] bpf: Reject MEM_ALLOC BTF accesses past object bounds From: Eduard Zingerman To: Yiyang Chen , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Kumar Kartikeya Dwivedi Cc: John Fastabend , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Shuah Khan , bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Date: Thu, 25 Jun 2026 13:34:24 -0700 In-Reply-To: <703a2cbfeb17ae707fa4a003b795c5326cc0abb8.1782197377.git.chenyy23@mails.tsinghua.edu.cn> References: <703a2cbfeb17ae707fa4a003b795c5326cc0abb8.1782197377.git.chenyy23@mails.tsinghua.edu.cn> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.60.1 (3.60.1-1.fc44) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Tue, 2026-06-23 at 17:34 +0000, Yiyang Chen wrote: > BTF struct walks relax the struct-size check for accesses through a > trailing flexible array. That is valid for ordinary BTF type walking, but > PTR_TO_BTF_ID | MEM_ALLOC values point to objects allocated with the stat= ic > BTF type size. >=20 > When walking a MEM_ALLOC object, reject the access before applying the > flexible-array relaxation if the access range extends past the struct siz= e. > This keeps verifier-approved BTF accesses within the bytes provided by th= e > allocation kfunc. >=20 > Fixes: 958cf2e273f0 ("bpf: Introduce bpf_obj_new") > Fixes: 36d8bdf75a93 ("bpf: Add alloc/xchg/direct_access support for local= percpu kptr") > Signed-off-by: Yiyang Chen > --- Acked-by: Eduard Zingerman > kernel/bpf/btf.c | 14 +++++++++----- > 1 file changed, 9 insertions(+), 5 deletions(-) >=20 > diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c > index 15ae7c43f..3e68af9c1 100644 > --- a/kernel/bpf/btf.c > +++ b/kernel/bpf/btf.c > @@ -7069,7 +7069,7 @@ enum bpf_struct_walk_result { > static int btf_struct_walk(struct bpf_verifier_log *log, const struct bt= f *btf, > const struct btf_type *t, int off, int size, > u32 *next_btf_id, enum bpf_type_flag *flag, > - const char **field_name) > + const char **field_name, bool is_alloc) Nit: 'walk_flex_arrays' would be a better name. > { > u32 i, moff, mtrue_end, msize =3D 0, total_nelems =3D 0; > const struct btf_type *mtype, *elem_type =3D NULL; [...]