linux-yocto/kernel/bpf
Daniel Borkmann 41688d1fc5 bpf: Fix oob access in cgroup local storage
[ Upstream commit abad3d0bad ]

Lonial reported that an out-of-bounds access in cgroup local storage
can be crafted via tail calls. Given two programs each utilizing a
cgroup local storage with a different value size, and one program
doing a tail call into the other. The verifier will validate each of
the indivial programs just fine. However, in the runtime context
the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the
BPF program as well as any cgroup local storage flavor the program
uses. Helpers such as bpf_get_local_storage() pick this up from the
runtime context:

  ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx);
  storage = ctx->prog_item->cgroup_storage[stype];

  if (stype == BPF_CGROUP_STORAGE_SHARED)
    ptr = &READ_ONCE(storage->buf)->data[0];
  else
    ptr = this_cpu_ptr(storage->percpu_buf);

For the second program which was called from the originally attached
one, this means bpf_get_local_storage() will pick up the former
program's map, not its own. With mismatching sizes, this can result
in an unintended out-of-bounds access.

To fix this issue, we need to extend bpf_map_owner with an array of
storage_cookie[] to match on i) the exact maps from the original
program if the second program was using bpf_get_local_storage(), or
ii) allow the tail call combination if the second program was not
using any of the cgroup local storage maps.

Fixes: 7d9c342789 ("bpf: Make cgroup storages shared between programs on the same cgroup")
Reported-by: Lonial Con <kongln9170@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20250730234733.530041-4-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-09-09 18:58:01 +02:00
..
preload bpf/preload: Don't select USERMODE_DRIVER 2025-08-15 12:13:48 +02:00
arena.c bpf: Fix softlockup in arena_map_free on 64k page kernel 2025-02-27 04:30:19 -08:00
arraymap.c bpf: Prevent tailcall infinite loop caused by freplace 2024-12-14 20:03:49 +01:00
bloom_filter.c
bpf_cgrp_storage.c bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage 2025-05-02 07:59:16 +02:00
bpf_inode_storage.c
bpf_iter.c [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
bpf_local_storage.c bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT 2025-02-08 09:57:29 +01:00
bpf_lru_list.c bpf: Adjust free target to avoid global starvation of LRU map 2025-07-17 18:37:22 +02:00
bpf_lru_list.h bpf: Adjust free target to avoid global starvation of LRU map 2025-07-17 18:37:22 +02:00
bpf_lsm.c bpf, lsm: Remove bpf_lsm_key_free hook 2024-10-08 12:52:40 -07:00
bpf_struct_ops.c bpf: Pass the same orig_call value to trampoline functions 2025-06-27 11:11:31 +01:00
bpf_task_storage.c
btf_iter.c
btf_relocate.c
btf.c bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index 2025-06-27 11:11:33 +01:00
cgroup_iter.c
cgroup.c bpf: Allow pre-ordering for bpf cgroup progs 2025-05-29 11:02:17 +02:00
core.c bpf: Fix oob access in cgroup local storage 2025-09-09 18:58:01 +02:00
cpumap.c
cpumask.c
crypto.c
devmap.c bpf: fix OOB devmap writes when deleting elements 2024-12-14 20:03:30 +01:00
disasm.c
disasm.h
dispatcher.c bpf: Add kernel symbol for struct_ops trampoline 2024-12-05 14:01:57 +01:00
hashtab.c bpf: fix possible endless loop in BPF map iteration 2025-05-29 11:02:01 +02:00
helpers.c bpf: Ensure RCU lock is held around bpf_prog_ksym_find 2025-08-15 12:13:41 +02:00
inode.c bpf: Preserve param->string when parsing mount options 2024-10-22 12:56:38 -07:00
Kconfig
link_iter.c
local_storage.c
log.c bpf: Fix print_reg_state's constant scalar dump 2024-10-17 11:06:34 -07:00
lpm_trie.c bpf: Fix exact match conditions in trie_get_next_key() 2024-12-14 20:03:19 +01:00
Makefile
map_in_map.c
map_in_map.h
map_iter.c
memalloc.c bpf: Add bpf_mem_alloc_check_size() helper 2024-10-30 12:13:46 -07:00
mmap_unlock_work.h
mprog.c
net_namespace.c
offload.c
percpu_freelist.c
percpu_freelist.h
prog_iter.c
queue_stack_maps.c
relo_core.c
reuseport_array.c
ringbuf.c bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic 2025-02-27 04:30:18 -08:00
stackmap.c
syscall.c bpf: Move bpf map owner out of common struct 2025-09-09 18:58:01 +02:00
sysfs_btf.c
task_iter.c bpf: Fix iter/task tid filtering 2024-10-17 10:52:18 -07:00
tcx.c
tnum.c
token.c
trampoline.c bpf: Prevent tailcall infinite loop caused by freplace 2024-12-14 20:03:49 +01:00
verifier.c bpf: Make reg_not_null() true for CONST_PTR_TO_MAP 2025-08-20 18:30:39 +02:00