]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
bpf: Fix stackmap overflow check in __bpf_get_stackid()
authorArnaud Lecomte <contact@arnaud-lcm.com>
Sat, 25 Oct 2025 19:29:41 +0000 (19:29 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 18 Dec 2025 12:54:50 +0000 (13:54 +0100)
commitd1f424a77b6bd27b361737ed73df49a0158f1590
tree94fdd54155ff61cbf4a266ab624808ece8c7ca7f
parent0c472ae306761526ba5e96bc4a618e29edb3a85c
bpf: Fix stackmap overflow check in __bpf_get_stackid()

[ Upstream commit 23f852daa4bab4d579110e034e4d513f7d490846 ]

Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid()
when copying stack trace data. The issue occurs when the perf trace
 contains more stack entries than the stack map bucket can hold,
 leading to an out-of-bounds write in the bucket's data array.

Fixes: ee2a098851bf ("bpf: Adjust BPF stack helper functions to accommodate skip > 0")
Reported-by: syzbot+c9b724fbb41cf2538b7b@syzkaller.appspotmail.com
Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/bpf/20251025192941.1500-1-contact@arnaud-lcm.com
Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b
Signed-off-by: Sasha Levin <sashal@kernel.org>
kernel/bpf/stackmap.c