Merge branch 'bpf-reject-mem_alloc-btf-accesses-past-bounds'

Browse source

Yiyang Chen says:

====================
bpf: Reject MEM_ALLOC BTF accesses past bounds

BTF struct walks can relax the top-level struct-size check for trailing
flexible arrays. That relaxation must not let a PTR_TO_BTF_ID | MEM_ALLOC
access escape the bytes allocated by bpf_obj_new() or bpf_percpu_obj_new().

Patch 1 rejects MEM_ALLOC BTF walks whose access range reaches past the
current struct size before applying the flexible-array relaxation. This now
also applies to struct ID matching used by kfunc and kptr type checks.
Patch 2 adds a linked_list negative loader case for this path.

Changes in v3:
- Pass the flexible-array walk policy through btf_struct_ids_match() callers,
  so MEM_ALLOC kfunc/kptr type checks use the same bounds rule.
- Rename the btf_struct_walk() parameter to walk_flex_arrays.
- Rebase onto current bpf-next.

v2:
https://lore.kernel.org/bpf/cover.1782197377.git.chenyy23@mails.tsinghua.edu.cn/

v1:
https://lore.kernel.org/bpf/cover.1782100805.git.chenyy23@mails.tsinghua.edu.cn/
====================

Link: https://patch.msgid.link/cover.1782807039.git.chenyy23@mails.tsinghua.edu.cn
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

...

This commit is contained in:

Kumar Kartikeya Dwivedi 2026-07-07 00:19:32 +02:00

parent 0bebfaa39d 4137bbd9af

commit dfe39ce7b0

No known key found for this signature in database

GPG key ID: 472D377B63542F83

5 changed files with 43 additions and 11 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

include/linux/bpf.h

View file

17

kernel/bpf/btf.c

View file

11

kernel/bpf/verifier.c

View file

1

tools/testing/selftests/bpf/prog_tests/linked_list.c

View file

23

tools/testing/selftests/bpf/progs/linked_list_fail.c

View file