[STABLE REQUEST] bpf: backport de36adca6346 to 7.1.y

하태구 <[email protected]>
Newsgroups org.kernel.vger.stable,org.kernel.vger.bpf
Message-ID <CAPa51zmwhbD2Xc1kFJY8HmpG-DY3OsK=G=h2Yn5ismeGCxo==g@mail.gmail.com>
Hello,

Please consider backporting the following upstream commit to Linux 7.1.y:

de36adca634634c205a9eb8b56a28175ab7abf5f
("bpf: reject overlarge global subprog argument sizes")

The issue was introduced by:

2cb27158adb3 ("bpf: poison dead stack slots")

which is present in Linux 7.1.

The fix rejects BTF-derived global subprogram argument sizes larger
than S32_MAX. Without the check, the caller-side PTR_TO_STACK
validation can interpret an overlarge size differently from the
callee-side PTR_TO_MEM state, potentially allowing the verifier to
validate accesses outside the actual stack object.

The upstream commit includes a selftest and applies cleanly to the
current linux-7.1.y tree. The fix is present in Linux 7.2 but is not
present in Linux 7.1.10 or the current 7.1 stable queue.

Upstream commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=de36adca634634c205a9eb8b56a28175ab7abf5f

Target stable series:

7.1.y

Thank you,
Taegu Ha
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.