Skip to content

Conversation

kernel-patches-daemon-bpf[bot]
Copy link

Pull request for series with
subject: bpf: refactor max_depth computation in bpf_get_stack()
version: 4
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=993141

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: bf7a6a6
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=993141
version: 4

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: b5bbbb7
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=993141
version: 4

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 2693227
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=993141
version: 4

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 78e097f
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=993141
version: 4

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 21aeabb
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=993141
version: 4

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 0780f54
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=993141
version: 4

A new helper function stack_map_calculate_max_depth() that
computes the max depth for a stackmap.

Changes in v2:
 - Removed the checking 'map_size % map_elem_size' from
   stack_map_calculate_max_depth
 - Changed stack_map_calculate_max_depth params name to be more generic

Changes in v3:
 - Changed map size param to size in max depth helper

Changes in v4:
 - Fixed indentation in max depth helper for args

Link to v3: https://lore.kernel.org/all/[email protected]/

Signed-off-by: Arnaud Lecomte <[email protected]>
Acked-by: Yonghong Song <[email protected]>
Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid()
when copying stack trace data. The issue occurs when the perf trace
 contains more stack entries than the stack map bucket can hold,
 leading to an out-of-bounds write in the bucket's data array.

Changes in v2:
 - Fixed max_depth names across get stack id

Changes in v4:
 - Removed unnecessary empty line in __bpf_get_stackid

Link to v3: https://lore.kernel.org/all/[email protected]/

Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=c9b724fbb41cf2538b7b
Signed-off-by: Arnaud Lecomte <[email protected]>
Acked-by: Yonghong Song <[email protected]>
@kernel-patches-daemon-bpf
Copy link
Author

At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=993141 expired. Closing PR.

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot deleted the series/993141=>bpf-next branch August 24, 2025 23:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant