]> git.ipfire.org Git - thirdparty/linux.git/commit
bpf: Fix stackmap overflow check in __bpf_get_stackid()
authorArnaud Lecomte <contact@arnaud-lcm.com>
Sat, 25 Oct 2025 19:29:41 +0000 (19:29 +0000)
committerAndrii Nakryiko <andrii@kernel.org>
Tue, 28 Oct 2025 16:20:27 +0000 (09:20 -0700)
commit23f852daa4bab4d579110e034e4d513f7d490846
tree1449ed2f3ad3df3a68e3868afb4a883eef4ef4ea
parente17d62fedd10ae56e2426858bd0757da544dbc73
bpf: Fix stackmap overflow check in __bpf_get_stackid()

Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid()
when copying stack trace data. The issue occurs when the perf trace
 contains more stack entries than the stack map bucket can hold,
 leading to an out-of-bounds write in the bucket's data array.

Fixes: ee2a098851bf ("bpf: Adjust BPF stack helper functions to accommodate skip > 0")
Reported-by: syzbot+c9b724fbb41cf2538b7b@syzkaller.appspotmail.com
Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/bpf/20251025192941.1500-1-contact@arnaud-lcm.com
Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b
kernel/bpf/stackmap.c