[STABLE REQUEST] bpf: backport de36adca6346 to 7.1.y
하태구 <[email protected]>
| Newsgroups | org.kernel.vger.stable,org.kernel.vger.bpf |
|---|---|
| Message-ID | <CAPa51zmwhbD2Xc1kFJY8HmpG-DY3OsK=G=h2Yn5ismeGCxo==g@mail.gmail.com> |
Hello,
Please consider backporting the following upstream commit to Linux 7.1.y:
de36adca634634c205a9eb8b56a28175ab7abf5f
("bpf: reject overlarge global subprog argument sizes")
The issue was introduced by:
2cb27158adb3 ("bpf: poison dead stack slots")
which is present in Linux 7.1.
The fix rejects BTF-derived global subprogram argument sizes larger
than S32_MAX. Without the check, the caller-side PTR_TO_STACK
validation can interpret an overlarge size differently from the
callee-side PTR_TO_MEM state, potentially allowing the verifier to
validate accesses outside the actual stack object.
The upstream commit includes a selftest and applies cleanly to the
current linux-7.1.y tree. The fix is present in Linux 7.2 but is not
present in Linux 7.1.10 or the current 7.1 stable queue.
Upstream commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=de36adca634634c205a9eb8b56a28175ab7abf5f
Target stable series:
7.1.y
Thank you,
Taegu Ha