linux-kernel - Re: [PATCH bpf-next v7 2/3] bpf: clean-up bounds checking in __bpf_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <31e8303f-5878-4027-a67a-770089cefbe1@arnaud-lcm.com>
Date: Fri, 5 Sep 2025 00:52:29 +0200
From: "Lecomte, Arnaud" <contact@...aud-lcm.com>
To: Song Liu <song@...nel.org>, alexei.starovoitov@...il.com,
 yonghong.song@...ux.dev
Cc: andrii@...nel.org, ast@...nel.org, bpf@...r.kernel.org,
 daniel@...earbox.net, eddyz87@...il.com, haoluo@...gle.com,
 john.fastabend@...il.com, jolsa@...nel.org, kpsingh@...nel.org,
 linux-kernel@...r.kernel.org, martin.lau@...ux.dev, sdf@...ichev.me,
 syzbot+c9b724fbb41cf2538b7b@...kaller.appspotmail.com,
 syzkaller-bugs@...glegroups.com
Subject: Re: [PATCH bpf-next v7 2/3] bpf: clean-up bounds checking in
 __bpf_get_stack


On 05/09/2025 00:40, Song Liu wrote:
>
> On 9/3/25 4:40 PM, Arnaud Lecomte wrote:
>> Clean-up bounds checking for trace->nr in
>> __bpf_get_stack by limiting it only to
>> max_depth.
>>
>> Signed-off-by: Arnaud Lecomte <contact@...aud-lcm.com>
>> Cc: Song Lui <song@...nel.org>
>
> Typo in my name, which is "Song Liu".
>
> This looks right.
>
> Acked-by: Song Liu <song@...nel.org>
>
Oops sorry !
>> ---
>>   kernel/bpf/stackmap.c | 9 +++++----
>>   1 file changed, 5 insertions(+), 4 deletions(-)
>>
>> diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
>> index ed707bc07173..9f3ae426ddc3 100644
>> --- a/kernel/bpf/stackmap.c
>> +++ b/kernel/bpf/stackmap.c
>> @@ -462,13 +462,15 @@ static long __bpf_get_stack(struct pt_regs 
>> *regs, struct task_struct *task,
>>       if (may_fault)
>>           rcu_read_lock(); /* need RCU for perf's callchain below */
>>   -    if (trace_in)
>> +    if (trace_in) {
>>           trace = trace_in;
>> -    else if (kernel && task)
>> +        trace->nr = min_t(u32, trace->nr, max_depth);
>> +    } else if (kernel && task) {
>>           trace = get_callchain_entry_for_task(task, max_depth);
>> -    else
>> +    } else {
>>           trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
>>                          crosstask, false);
>> +    }
>>         if (unlikely(!trace) || trace->nr < skip) {
>>           if (may_fault)
>> @@ -477,7 +479,6 @@ static long __bpf_get_stack(struct pt_regs *regs, 
>> struct task_struct *task,
>>       }
>>         trace_nr = trace->nr - skip;
>> -    trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem;
>>       copy_len = trace_nr * elem_size;
>>         ips = trace->ip + skip;
>