linux-kernel - Re: [PATCH bpf-next v4 2/2] bpf: fix stackmap overflow check in __bpf_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ae450780-f2a9-46fc-8e49-3528ff2e5daa@linux.dev>
Date: Mon, 18 Aug 2025 10:02:52 -0700
From: Yonghong Song <yonghong.song@...ux.dev>
To: "Lecomte, Arnaud" <contact@...aud-lcm.com>, song@...nel.org,
 jolsa@...nel.org
Cc: andrii@...nel.org, ast@...nel.org, bpf@...r.kernel.org,
 daniel@...earbox.net, eddyz87@...il.com, haoluo@...gle.com,
 john.fastabend@...il.com, kpsingh@...nel.org, linux-kernel@...r.kernel.org,
 martin.lau@...ux.dev, sdf@...ichev.me,
 syzbot+c9b724fbb41cf2538b7b@...kaller.appspotmail.com,
 syzkaller-bugs@...glegroups.com
Subject: Re: [PATCH bpf-next v4 2/2] bpf: fix stackmap overflow check in
 __bpf_get_stackid()



On 8/18/25 9:57 AM, Yonghong Song wrote:
>
>
> On 8/18/25 6:49 AM, Lecomte, Arnaud wrote:
>> Hey,
>> Just forwarding the patch to the associated maintainers with 
>> `stackmap.c`.
>
> Arnaud, please add Ack (provided in comments for v3) to make things 
> easier
> for maintainers.
>
> Also, looks like all your patch sets (v1 to v4) in the same thread.

sorry, it should be v3 and v4 in the same thread.

> It would be good to have all these versions in separate thread.
> Please look at some examples in bpf mailing list.
>
>> Have a great day,
>> Cheers
>>
>> On 13/08/2025 21:55, Arnaud Lecomte wrote:
>>> Syzkaller reported a KASAN slab-out-of-bounds write in 
>>> __bpf_get_stackid()
>>> when copying stack trace data. The issue occurs when the perf trace
>>>   contains more stack entries than the stack map bucket can hold,
>>>   leading to an out-of-bounds write in the bucket's data array.
>>>
>>> Changes in v2:
>>>   - Fixed max_depth names across get stack id
>>>
>>> Changes in v4:
>>>   - Removed unnecessary empty line in __bpf_get_stackid
>>>
>>> Reported-by: syzbot+c9b724fbb41cf2538b7b@...kaller.appspotmail.com
>>> Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b
>>> Signed-off-by: Arnaud Lecomte <contact@...aud-lcm.com>
>>> ---
>>>   kernel/bpf/stackmap.c | 23 +++++++++++++----------
>>>   1 file changed, 13 insertions(+), 10 deletions(-)
>>>
> [...]
>
>