diff options
| author | Alexei Starovoitov <ast@kernel.org> | 2026-04-12 13:34:41 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-04-12 13:36:55 -0700 |
| commit | fa2942918afbd0cb765277e2fd09fe0aaef6dd8d (patch) | |
| tree | 8a6f90c01125907c5df780c988655bce740d4762 /rust/kernel/ptr | |
| parent | 2fefa9c81a25534464911447d51ddb44b04a8e5b (diff) | |
| parent | 171609f047552b51b8ed78f338cbffb84b7f5e8f (diff) | |
Merge patch series "bpf: Fix OOB in pcpu_init_value and add a test"
xulang <xulang@uniontech.com> says:
====================
Fix OOB read when copying element from a BPF_MAP_TYPE_CGROUP_STORAGE
map to another pcpu map with the same value_size that is not rounded
up to 8 bytes, and add a test case to reproduce the issue.
The root cause is that pcpu_init_value() uses copy_map_value_long() which
rounds up the copy size to 8 bytes, but CGROUP_STORAGE map values are not
8-byte aligned (e.g., 4-byte). This causes a 4-byte OOB read when
the copy is performed.
====================
Link: https://lore.kernel.org/r/7653EEEC2BAB17DF+20260402073948.2185396-1-xulang@uniontech.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'rust/kernel/ptr')
0 files changed, 0 insertions, 0 deletions
