linux-kernel - Re: [PATCH bpf-next v4 2/2] bpf: fix stackmap overflow check in __bpf_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a0d0ed39-3c47-42dc-bdf9-a1961368b166@arnaud-lcm.com>
Date: Tue, 19 Aug 2025 17:20:57 +0100
From: Arnaud Lecomte <contact@...aud-lcm.com>
To: Yonghong Song <yonghong.song@...ux.dev>, song@...nel.org, jolsa@...nel.org
Cc: andrii@...nel.org, ast@...nel.org, bpf@...r.kernel.org,
 daniel@...earbox.net, eddyz87@...il.com, haoluo@...gle.com,
 john.fastabend@...il.com, kpsingh@...nel.org, linux-kernel@...r.kernel.org,
 martin.lau@...ux.dev, sdf@...ichev.me,
 syzbot+c9b724fbb41cf2538b7b@...kaller.appspotmail.com,
 syzkaller-bugs@...glegroups.com
Subject: Re: [PATCH bpf-next v4 2/2] bpf: fix stackmap overflow check in
 __bpf_get_stackid()

On 18/08/2025 18:02, Yonghong Song wrote:
>
>
> On 8/18/25 9:57 AM, Yonghong Song wrote:
>>
>>
>> On 8/18/25 6:49 AM, Lecomte, Arnaud wrote:
>>> Hey,
>>> Just forwarding the patch to the associated maintainers with 
>>> `stackmap.c`.
>>
>> Arnaud, please add Ack (provided in comments for v3) to make things 
>> easier
>> for maintainers.
>>
>> Also, looks like all your patch sets (v1 to v4) in the same thread.
>
> sorry, it should be v3 and v4 in the same thread.
>
Hey, ty for the feedback !
I am going to provide the link to the v3 in the v4 commit and resent the 
v4 with the Acked-by.

>> It would be good to have all these versions in separate thread.
>> Please look at some examples in bpf mailing list.
>>
>>> Have a great day,
>>> Cheers
>>>
>>> On 13/08/2025 21:55, Arnaud Lecomte wrote:
>>>> Syzkaller reported a KASAN slab-out-of-bounds write in 
>>>> __bpf_get_stackid()
>>>> when copying stack trace data. The issue occurs when the perf trace
>>>>   contains more stack entries than the stack map bucket can hold,
>>>>   leading to an out-of-bounds write in the bucket's data array.
>>>>
>>>> Changes in v2:
>>>>   - Fixed max_depth names across get stack id
>>>>
>>>> Changes in v4:
>>>>   - Removed unnecessary empty line in __bpf_get_stackid
>>>>
>>>> Reported-by: syzbot+c9b724fbb41cf2538b7b@...kaller.appspotmail.com
>>>> Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b
>>>> Signed-off-by: Arnaud Lecomte <contact@...aud-lcm.com>
>>>> ---
>>>>   kernel/bpf/stackmap.c | 23 +++++++++++++----------
>>>>   1 file changed, 13 insertions(+), 10 deletions(-)
>>>>
>> [...]
>>
>>
>
>