Merge branch 'bpf-bound-rdonly-rdwr_buf_size-kfunc-return-size'

Browse source

Nicholas Dudar says:

====================
bpf: bound rdonly/rdwr_buf_size kfunc return size

check_kfunc_args() stores a kfunc's rdonly_buf_size/rdwr_buf_size
argument into a u64 that check_kfunc_call() later narrows into the
returned register's u32 mem_size, so a value above U32_MAX truncates
instead of being rejected. Fix it and add a selftest for coverage.

Changelog:
----------
v1 -> v2 (v1 was a private report to security@kernel.org)

 * Split the fix and selftest into separate patches.
 * Target bpf-next instead of bpf.
====================

Link: https://patch.msgid.link/20260709155837.1879230-1-main.kalliope@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

...

This commit is contained in:

Kumar Kartikeya Dwivedi 2026-07-09 22:17:56 +02:00

parent c3d5ef291a 12556c3198

commit a4553044d1

No known key found for this signature in database

GPG key ID: 472D377B63542F83

3 changed files with 39 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

kernel/bpf/verifier.c

View file

1

tools/testing/selftests/bpf/prog_tests/kfunc_call.c

View file

33

tools/testing/selftests/bpf/progs/kfunc_call_fail.c

View file