Hi, On 4/7/2024 10:24 PM, Alexei Starovoitov wrote: > On Sun, Apr 7, 2024 at 2:09 AM Hou Tao <houtao@xxxxxxxxxxxxxxx> wrote: >> Hi, >> >> On 4/6/2024 9:44 PM, syzbot wrote: >>> Hello, >>> >>> syzbot found the following issue on: >>> >>> HEAD commit: 443574b03387 riscv, bpf: Fix kfunc parameters incompatibil.. >>> git tree: bpf >>> console+strace: https://syzkaller.appspot.com/x/log.txt?x=148ad855180000 >>> kernel config: https://syzkaller.appspot.com/x/.config?x=6fb1be60a193d440 >>> dashboard link: https://syzkaller.appspot.com/bug?extid=9459b5d7fab774cf182f >>> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 >>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13d86795180000 >>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=143eff76180000 >> According to the reproducer, it passes a big value_size (0xfffffe00) >> when creating bloom filter map. The big value_size bypasses the check in >> check_stack_access_within_bounds(). I think a proper fix needs to add >> these following two checks: >> (1) in check_stack_access_within_bounds() add check for negative >> access_size >> (2) in bloom_map_alloc() limit the max value of bloom_map_alloc(). >> >> Will post a patch to fix the syzbot report. Will also check whether or >> not there are similar problems for other bpf maps. > Isn't it fixed by > https://lore.kernel.org/all/20240327024245.318299-2-andreimatei1@xxxxxxxxx/ Yes. Totally missed the patch set. The patch set will fix the syzbot reported problem.
