From: Nicholas Dudar <main.kalliope@gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 2aaf67f0516fde29620d0edfc29c01b9ea7ad430 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18570 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- check_kfunc_args() detects a kfunc argument named rdonly_buf_size or rdwr_buf_size and stores reg->var_off.value into meta->r0_size, a u64, and does not bound it. check_kfunc_call() later copies that value into the returned register's mem_size field: meta->r0_size = reg->var_off.value; ... regs[BPF_REG_0].mem_size = meta.r0_size; regs[BPF_REG_0].mem_size is u32. A constant whose upper 32 bits are set gets truncated instead of causing a load-time rejection, so the verifier records a PTR_TO_MEM register with an approximately 4 GiB mem_size for whatever allocation the kfunc returned. A later access check against that register uses the truncated, wrong bound. Reject rdonly_buf_size/rdwr_buf_size values that exceed U32_MAX at the point meta->r0_size is set. Fixes: eb1f7f71c126 ("bpf/verifier: allow kfunc to return an allocated mem") Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260709155837.1879230-2-main.kalliope@gmail.com Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Conflicts: kernel/bpf/verifier.c [commit e0b7b91c72db6dae0392dd90db3b866218a7870b not backport] Signed-off-by: Chen Yuxi <chenyuxi19@huawei.com> --- kernel/bpf/verifier.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index bdeb3f5c72e7..1f94aaad5575 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11668,6 +11668,11 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ } meta->r0_size = reg->var_off.value; + if (meta->r0_size > U32_MAX) { + verbose(env, "R%d rdonly/rdwr_buf_size exceeds u32 max\n", + regno); + return -EINVAL; + } ret = mark_chain_precision(env, regno); if (ret) return ret; -- 2.34.1