Skip to content

Conversation

@kernel-patches-daemon-bpf-rc
Copy link

Pull request for series with
subject: bpf: refactor max_depth computation in bpf_get_stack()
version: 5
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=995805

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: d0f27ff
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=995805
version: 5

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 2465bb8
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=995805
version: 5

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 2660b9d
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=995805
version: 5

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: d3abefe
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=995805
version: 5

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 4c229f3
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=995805
version: 5

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: bd27626
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=995805
version: 5

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 737433c
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=995805
version: 5

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 98857d1
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=995805
version: 5

A new helper function stack_map_calculate_max_depth() that
computes the max depth for a stackmap.

Changes in v2:
 - Removed the checking 'map_size % map_elem_size' from
   stack_map_calculate_max_depth
 - Changed stack_map_calculate_max_depth params name to be more generic

Changes in v3:
 - Changed map size param to size in max depth helper

Changes in v4:
 - Fixed indentation in max depth helper for args

Changes in v5:
 - Bound back trace_nr to num_elem in __bpf_get_stack
 - Make a copy of sysctl_perf_event_max_stack
   in stack_map_calculate_max_depth

Link to v4: https://lore.kernel.org/all/[email protected]/

Signed-off-by: Arnaud Lecomte <[email protected]>
Acked-by: Yonghong Song <[email protected]>
Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid()
when copying stack trace data. The issue occurs when the perf trace
 contains more stack entries than the stack map bucket can hold,
 leading to an out-of-bounds write in the bucket's data array.

Changes in v2:
 - Fixed max_depth names across get stack id

Changes in v4:
 - Removed unnecessary empty line in __bpf_get_stackid

Link to v4: https://lore.kernel.org/all/[email protected]/

Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b
Signed-off-by: Arnaud Lecomte <[email protected]>
Acked-by: Yonghong Song <[email protected]>
@kernel-patches-daemon-bpf-rc
Copy link
Author

At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=995805 expired. Closing PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants