Skip to content

Conversation

@kernel-patches-daemon-bpf-rc
Copy link

Pull request for series with
subject: bpf: refactor max_depth computation in bpf_get_stack()
version: 7
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=998624

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: c9110e6
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=998624
version: 7

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: abc8a95
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=998624
version: 7

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 929adf8
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=998624
version: 7

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 2d92ef7
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=998624
version: 7

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: b338cf8
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=998624
version: 7

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: b338cf8
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=998624
version: 7

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: b338cf8
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=998624
version: 7

A new helper function stack_map_calculate_max_depth() that
computes the max depth for a stackmap.

Changes in v2:
 - Removed the checking 'map_size % map_elem_size' from
   stack_map_calculate_max_depth
 - Changed stack_map_calculate_max_depth params name to be more generic

Changes in v3:
 - Changed map size param to size in max depth helper

Changes in v4:
 - Fixed indentation in max depth helper for args

Changes in v5:
 - Bound back trace_nr to num_elem in __bpf_get_stack
 - Make a copy of sysctl_perf_event_max_stack
   in stack_map_calculate_max_depth

Changes in v6:
 - Restrained max_depth computation only when required
 - Additional cleanup from Song in __bpf_get_stack

Changes in v7:
 - Removed additional cleanup from v6

Link to v6: https://lore.kernel.org/all/[email protected]/

Signed-off-by: Arnaud Lecomte <[email protected]>
Acked-by: Yonghong Song <[email protected]>
Acked-by: Song Liu <[email protected]>
Clean-up bounds checking for trace->nr in
__bpf_get_stack by limiting it only to
max_depth.

Signed-off-by: Arnaud Lecomte <[email protected]>
Cc: Song Lui <[email protected]>
Acked-by: Song Liu <[email protected]>
Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid()
when copying stack trace data. The issue occurs when the perf trace
 contains more stack entries than the stack map bucket can hold,
 leading to an out-of-bounds write in the bucket's data array.

Changes in v2:
 - Fixed max_depth names across get stack id

Changes in v4:
 - Removed unnecessary empty line in __bpf_get_stackid

Changs in v6:
 - Added back trace_len computation in __bpf_get_stackid

Link to v6: https://lore.kernel.org/all/[email protected]/

Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b
Fixes: ee2a098 ("bpf: Adjust BPF stack helper functions to accommodate skip > 0")
Signed-off-by: Arnaud Lecomte <[email protected]>
Acked-by: Yonghong Song <[email protected]>
Acked-by: Yonghong Song <[email protected]>
@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 9621eb6
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=998624
version: 7

@kernel-patches-daemon-bpf-rc kernel-patches-daemon-bpf-rc bot deleted the series/998624=>bpf-next branch September 7, 2025 21:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants