bpf: Clamp trace length in __bpf_get_stack to fix OOB write #6330
Conversation
|
Upstream branch: 026bcf9 |
|
Upstream branch: 026bcf9 |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/1021938=>bpf-next
branch
from
36c9915 to
17ceb7e
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
4eb9670 to
e1b05fd
Compare
|
Upstream branch: f1d8c65 |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/1021938=>bpf-next
branch
from
17ceb7e to
2bd2a53
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
e1b05fd to
b1af442
Compare
|
Upstream branch: 93ce3be |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/1021938=>bpf-next
branch
from
2bd2a53 to
a08f4db
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
b1af442 to
67d3dd3
Compare
|
Upstream branch: 93ce3be |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/1021938=>bpf-next
branch
from
a08f4db to
29404f5
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
67d3dd3 to
488318d
Compare
|
Upstream branch: c1da3df |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/1021938=>bpf-next
branch
from
29404f5 to
4cfae15
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
488318d to
728ac5f
Compare
|
Upstream branch: fea3f5e |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/1021938=>bpf-next
branch
from
4cfae15 to
d4e9ddd
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
728ac5f to
4fcc7e1
Compare
|
Upstream branch: 63066b7 |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/1021938=>bpf-next
branch
from
d4e9ddd to
1ed47aa
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
4fcc7e1 to
1aeb398
Compare
|
Upstream branch: c133390 |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/1021938=>bpf-next
branch
from
1ed47aa to
b6776a0
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
1aeb398 to
f68d848
Compare
|
Upstream branch: ef2c0b2 |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/1021938=>bpf-next
branch
from
b6776a0 to
c066416
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
f68d848 to
3fd24de
Compare
|
Upstream branch: a4d31f4 |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/1021938=>bpf-next
branch
from
c066416 to
2f6455b
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
3fd24de to
22f76ea
Compare
|
Upstream branch: 4f7bc83 |
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/1021938=>bpf-next
branch
from
2f6455b to
8456f76
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
22f76ea to
d766c2f
Compare
|
Upstream branch: 6cc73f3 |
syzbot reported a stack-out-of-bounds write in __bpf_get_stack()
triggered via bpf_get_stack() when capturing a kernel stack trace.
After the recent refactor that introduced stack_map_calculate_max_depth(),
the code in stack_map_get_build_id_offset() (and related helpers) stopped
clamping the number of trace entries (`trace_nr`) to the number of elements
that fit into the stack map value (`num_elem`).
As a result, if the captured stack contained more frames than the map value
can hold, the subsequent memcpy() would write past the end of the buffer,
triggering a KASAN report like:
BUG: KASAN: stack-out-of-bounds in __bpf_get_stack+0x...
Write of size N at addr ... by task syz-executor...
Restore the missing clamp by limiting `trace_nr` to `num_elem` before
computing the copy length. This mirrors the pre-refactor logic and ensures
we never copy more bytes than the destination buffer can hold.
No functional change intended beyond reintroducing the missing bound check.
Reported-by: [email protected]
Fixes: e17d62f ("bpf: Refactor stack map trace depth calculation into helper function")
Signed-off-by: Brahmajit Das <[email protected]>
Acked-by: Yonghong Song <[email protected]>
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
series/1021938=>bpf-next
branch
from
8456f76 to
b39a762
Compare
kernel-patches-daemon-bpf-rc
bot
force-pushed
the
bpf-next_base
branch
from
d766c2f to
86f62c3
Compare
|
At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=1021938 expired. Closing PR. |
kernel-patches-daemon-bpf-rc
bot
deleted the
series/1021938=>bpf-next
branch
Pull request for series with
subject: bpf: Clamp trace length in __bpf_get_stack to fix OOB write
version: 3
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1021938