github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-06 10:36:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
ee363e0558
linux/kernel/bpf
History
Masoud Aghasi 953824e508 bpf: Fix u32 overflow issue in map batch operations 
Several map batch operation implementations such as
generic_map_lookup_batch() use calculations in the form of
"values + cp * map->value_size" to compute the desired userspace memory
address for reading or writing. This can overflow the u32 type
(the result of "cp * map->value_size") when the map size exceeds 4GB.

generic_map_lookup_batch() may corrupt values for some keys in
userspace memory, and in some cases it mismatches values for some keys
while still reporting success.

Other batch operations may fail to delete or update some keys,
or the syscall may return unexpected errors.

Add size_t casts to prevent the affected offset and size calculations
from overflowing.

Fixes: cb4d03ab49 ("bpf: Add generic support for lookup batch op")
Fixes: aa2e93b8e5 ("bpf: Add generic support for update and delete batch ops")
Fixes: 057996380a ("bpf: Add batch ops to all htab bpf map")
Signed-off-by: Masoud Aghasi <maghasi@disroot.org>
Link: https://lore.kernel.org/r/20260903082734.623904-1-maghasi@disroot.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-09-13 21:58:40 -07:00
..
preload umd: Remove usermode driver framework 2025-07-26 21:03:04 +02:00
arena.c bpf: Mark existing lock-safe kfuncs with KF_SPINLOCK_SAFE 2026-08-06 10:58:04 +02:00
arraymap.c bpf: Fix percpu map update indexing with sparse CPU IDs 2026-08-21 10:41:27 -07:00
backtrack.c bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks 2026-09-02 11:13:21 -07:00
bloom_filter.c bpf: Harden bloom filter sizing and indexing on 32-bit kernels 2026-08-05 11:45:20 -07:00
bpf_cgrp_storage.c bpf: Remove gfp_flags plumbing from bpf_local_storage_update() 2026-04-10 21:22:32 -07:00
bpf_inode_storage.c bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized 2026-06-30 16:31:56 +02:00
bpf_insn_array.c bpf: Lose const-ness of map in map_check_btf() 2026-02-27 15:39:00 -08:00
bpf_iter.c bpf: Reject non-scalar bpf_loop iteration counts 2026-09-05 20:50:13 -07:00
bpf_local_storage.c bpf: Remove gfp_flags plumbing from bpf_local_storage_update() 2026-04-10 21:22:32 -07:00
bpf_lru_list.c bpf: Fix NMI/tracepoint re-entry deadlock on lru locks 2026-06-07 18:46:13 -07:00
bpf_lru_list.h bpf: Fix NMI/tracepoint re-entry deadlock on lru locks 2026-06-07 18:46:13 -07:00
bpf_lsm_proto.c bpf: annotate file argument as __nullable in bpf_lsm_mmap_file 2025-12-21 10:56:33 -08:00
bpf_lsm.c bpf: Rename ARG_CONST_SIZE{,_OR_ZERO} to ARG_MEM_SIZE{,_OR_ZERO} 2026-08-03 00:29:14 +02:00
bpf_struct_ops.c bpf: Support __arena and __arena__nullable on struct_ops arguments 2026-08-08 03:03:26 -07:00
bpf_task_storage.c bpf: Remove gfp_flags plumbing from bpf_local_storage_update() 2026-04-10 21:22:32 -07:00
btf_iter.c
btf_relocate.c
btf.c bpf: Fix divide-by-zero in btf_struct_walk() 2026-09-10 16:58:05 -07:00
cfg.c bpf: don't rewrite bpf_fastcall patterns entered by a jump 2026-09-03 18:55:40 -07:00
cgroup_iter.c bpf: add new BPF_CGROUP_ITER_CHILDREN control option 2026-01-27 09:05:54 -08:00
cgroup.c bpf: Reject negative optlen in cgroup getsockopt hook 2026-08-17 11:33:29 +02:00
check_btf.c bpf: Rename 'early' BTF checking as a preparation phase 2026-08-08 03:03:25 -07:00
cnum_defs.h bpf: Export cnum_umin/umax() helpers for netronome driver 2026-04-27 10:09:48 -07:00
cnum.c bpf: representation and basic operations on circular numbers 2026-04-24 18:14:17 -07:00
const_fold.c bpf: Introduce global percpu data 2026-08-13 10:27:40 -07:00
core.c x86/bpf: Make arch_bpf_trampoline_size allocate from EXECMEM_MODULE_DATA 2026-08-20 17:52:31 +02:00
cpumap.c bpf: Add missing XDP_ABORTED handling in cpumap 2026-03-03 08:37:21 -08:00
cpumask.c bpf: Require a BPF cpumask for bpf_cpumask_populate() 2026-07-12 01:52:36 +02:00
crypto.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
devmap.c bpf: Run generic devmap egress prog on private skb 2026-06-12 18:21:01 -07:00
diagnostics.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
diagnostics.h bpf: Report Policy helper and kfunc errors 2026-08-15 11:15:17 -07:00
disasm.c bpf: update disasm.c to print BPF_PROBE_ATOMIC as atomics 2026-09-03 18:54:45 -07:00
disasm.h
dispatcher.c bpf: dispatcher: Allocate bpf_dispatcher->rw_image with vzalloc() 2026-07-22 17:26:39 +02:00
dmabuf_iter.c bpf: Fix truncated dmabuf iterator reads 2025-12-09 23:48:34 -08:00
fixups.c bpf: zero extend the result of an arena 32-bit cmpxchg 2026-09-03 18:54:45 -07:00
hashtab.c bpf: Fix u32 overflow issue in map batch operations 2026-09-13 21:58:40 -07:00
helpers.c bpf: Require CAP_PERFMON for kfuncs reading memory 2026-09-10 16:55:47 -07:00
inode.c bpf-next-7.2 2026-06-17 09:18:14 +01:00
Kconfig bpf: Update the bpf_prog_calc_tag to use SHA256 2025-09-18 19:10:20 -07:00
kmem_cache_iter.c
link_iter.c bpf: Clean up individual BTF_ID code 2025-07-16 18:34:42 -07:00
liveness.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
local_storage.c bpf: Fix percpu map update indexing with sparse CPU IDs 2026-08-21 10:41:27 -07:00
log.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
lpm_trie.c bpf: Allow LPM map access from sleepable BPF programs 2026-06-09 12:42:22 -07:00
Makefile bpf: Add verifier diagnostics report helpers 2026-08-15 11:11:16 -07:00
map_in_map.c bpf: Reject exclusive maps as inner maps in map-in-map 2026-06-01 18:36:40 -07:00
map_in_map.h
map_iter.c bpf: Implement iteration ops for resizable hashtab 2026-06-05 08:00:08 -07:00
memalloc.c bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk 2026-09-13 19:37:20 -07:00
mmap_unlock_work.h bpf: Fix mmap_lock leak in irq_work path 2026-08-08 10:25:36 +02:00
mprog.c
net_namespace.c bpf: Fix potential UAF in bpf_netns_link_update_prog 2026-07-30 15:28:46 -07:00
offload.c bpf: Fix use-after-free in offloaded map/prog info fill 2026-04-09 13:24:32 -07:00
percpu_freelist.c bpf: Fix infinite loop in pcpu_freelist push with one possible CPU 2026-08-20 20:44:16 +02:00
percpu_freelist.h bpf: Fix infinite loop in pcpu_freelist push with one possible CPU 2026-08-20 20:44:16 +02:00
prog_iter.c bpf: Clean up individual BTF_ID code 2025-07-16 18:34:42 -07:00
queue_stack_maps.c bpf: Drop duplicate blank lines in kernel/bpf/ 2026-08-13 10:27:40 -07:00
range_tree.c bpf: arena: Reintroduce memcg accounting 2026-01-02 14:31:59 -08:00
range_tree.h
relo_core.c
reuseport_array.c
ringbuf.c bpf: Fix available-data accounting on 32-bit wrap in overwrite mode 2026-08-14 15:20:37 -07:00
rqspinlock.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc7 2026-08-07 23:04:17 +02:00
rqspinlock.h rqspinlock: Protect waiters in queue from stalls 2025-03-19 08:03:05 -07:00
stackmap.c bpf: Mark faultable stack helpers as sleepable 2026-09-03 19:22:52 -07:00
states.c bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO 2026-08-28 10:44:21 -07:00
stream.c bpf: Add bpf_stream_print_stack stack dumping kfunc 2026-02-03 10:41:16 -08:00
syscall.c bpf: Fix u32 overflow issue in map batch operations 2026-09-13 21:58:40 -07:00
sysfs_btf.c Driver core changes for 6.17-rc1 2025-07-29 12:15:39 -07:00
task_iter.c bpf: Fix mmap_lock leak in irq_work path 2026-08-08 10:25:36 +02:00
tcx.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
tnum.c bpf: Simplify tnum_step() 2026-03-24 08:45:29 -07:00
token.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
trampoline.c bpf: Make bpf_trampoline_multi_detach return void 2026-08-13 02:52:23 +02:00
verifier.c bpf: Allow terminal gotox instructions 2026-09-12 10:26:05 -07:00