From: Alexei Starovoitov Date: Sun, 12 Apr 2026 20:34:41 +0000 (-0700) Subject: Merge patch series "bpf: Fix OOB in pcpu_init_value and add a test" X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fa2942918afbd0cb765277e2fd09fe0aaef6dd8d;p=thirdparty%2Fkernel%2Flinux.git Merge patch series "bpf: Fix OOB in pcpu_init_value and add a test" xulang says: ==================== Fix OOB read when copying element from a BPF_MAP_TYPE_CGROUP_STORAGE map to another pcpu map with the same value_size that is not rounded up to 8 bytes, and add a test case to reproduce the issue. The root cause is that pcpu_init_value() uses copy_map_value_long() which rounds up the copy size to 8 bytes, but CGROUP_STORAGE map values are not 8-byte aligned (e.g., 4-byte). This causes a 4-byte OOB read when the copy is performed. ==================== Link: https://lore.kernel.org/r/7653EEEC2BAB17DF+20260402073948.2185396-1-xulang@uniontech.com Signed-off-by: Alexei Starovoitov --- fa2942918afbd0cb765277e2fd09fe0aaef6dd8d