Skip to content

Conversation

kernel-patches-daemon-bpf[bot]
Copy link

Pull request for series with
subject: bpf: refactor max_depth computation in bpf_get_stack()
version: 9
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1001977

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: a578b54
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1001977
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: fd2e081
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1001977
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 32d3766
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1001977
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: f7528e4
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1001977
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 61ee2cc
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1001977
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 3ae4c52
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1001977
version: 9

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: b13448d
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1001977
version: 9

A new helper function stack_map_calculate_max_depth() that
computes the max depth for a stackmap.

Acked-by: Yonghong Song <[email protected]>
Acked-by: Song Liu <[email protected]>
Signed-off-by: Arnaud Lecomte <[email protected]>
Clean-up bounds checking for trace->nr in
__bpf_get_stack by limiting it only to
max_depth.

Acked-by: Song Liu <[email protected]>
Cc: Song Liu <[email protected]>
Signed-off-by: Arnaud Lecomte <[email protected]>
Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid()
when copying stack trace data. The issue occurs when the perf trace
 contains more stack entries than the stack map bucket can hold,
 leading to an out-of-bounds write in the bucket's data array.

Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b
Fixes: ee2a098 ("bpf: Adjust BPF stack helper functions to accommodate skip > 0")
Acked-by: Yonghong Song <[email protected]>
Acked-by: Song Liu <[email protected]>
Signed-off-by: Arnaud Lecomte <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant