From ca580b034380fa9a69cc973637d1859ec4f5b344 Mon Sep 17 00:00:00 2001 From: Alexei Starovoitov Date: Sun, 1 Nov 2026 19:05:11 +0000 Subject: [PATCH] bpf: Refuse to map an arena at address 0 The first mmap() of an arena sets user_vm_start and user_vm_end. Each subsequent mmap() must use the same range. The value 0 in user_vm_start means that the range is not set, but a mapping can start at address 0. Then arena_map_mmap() does not check vm_start and sets user_vm_start again. The range tree counts pages from user_vm_start. With a new user_vm_start it reports allocated pages as free, and apply_range_set_cb() fails with -EBUSY. An arena at address 0 is not useful, because the verifier rejects all progs that refer to it. Return -EINVAL from arena_get_unmapped_area(). It runs before mmap() removes the old mappings in the range. Fixes: 317460317a02 ("bpf: Introduce bpf_arena.") Signed-off-by: Alexei Starovoitov Link: https://patch.msgid.link/20261101190535.1454146-4-alexei.starovoitov@gmail.com --- kernel/bpf/arena.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c index 3c61c181a6fa..ad8aab551093 100644 --- a/kernel/bpf/arena.c +++ b/kernel/bpf/arena.c @@ -650,6 +650,9 @@ static unsigned long arena_get_unmapped_area(struct file *filp, unsigned long ad ret = mm_get_unmapped_area(filp, addr, len * 2, 0, flags); if (IS_ERR_VALUE(ret)) return ret; + if (!ret) + /* user_vm_start == 0 means that the user range is not set yet */ + return -EINVAL; if ((ret >> 32) == ((ret + len - 1) >> 32)) return ret; if (WARN_ON_ONCE(arena->user_vm_start))