Patch "bpf: Always use maximal size for copy_array()" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Always use maximal size for copy_array()

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-always-use-maximal-size-for-copy_array.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 6e8783225b0deb8e6de76cca54338f0cf441cf3e
Author: Kees Cook <keescook@xxxxxxxxxxxx>
Date:   Fri Dec 23 10:28:44 2022 -0800

    bpf: Always use maximal size for copy_array()
    
    [ Upstream commit 45435d8da71f9f3e6860e6e6ea9667b6ec17ec64 ]
    
    Instead of counting on prior allocations to have sized allocations to
    the next kmalloc bucket size, always perform a krealloc that is at least
    ksize(dst) in size (which is a no-op), so the size can be correctly
    tracked by all the various allocation size trackers (KASAN,
    __alloc_size, etc).
    
    Reported-by: Hyunwoo Kim <v4bel@xxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20221223094551.GA1439509@ubuntu
    Fixes: ceb35b666d42 ("bpf/verifier: Use kmalloc_size_roundup() to match ksize() usage")
    Cc: Alexei Starovoitov <ast@xxxxxxxxxx>
    Cc: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Cc: John Fastabend <john.fastabend@xxxxxxxxx>
    Cc: Andrii Nakryiko <andrii@xxxxxxxxxx>
    Cc: Martin KaFai Lau <martin.lau@xxxxxxxxx>
    Cc: Song Liu <song@xxxxxxxxxx>
    Cc: Yonghong Song <yhs@xxxxxx>
    Cc: KP Singh <kpsingh@xxxxxxxxxx>
    Cc: Stanislav Fomichev <sdf@xxxxxxxxxx>
    Cc: Hao Luo <haoluo@xxxxxxxxxx>
    Cc: Jiri Olsa <jolsa@xxxxxxxxxx>
    Cc: bpf@xxxxxxxxxxxxxxx
    Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20221223182836.never.866-kees@xxxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 242fe307032f..b4d5b343c191 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1000,6 +1000,8 @@ static void print_insn_state(struct bpf_verifier_env *env,
  */
 static void *copy_array(void *dst, const void *src, size_t n, size_t size, gfp_t flags)
 {
+	size_t alloc_bytes;
+	void *orig = dst;
 	size_t bytes;
 
 	if (ZERO_OR_NULL_PTR(src))
@@ -1008,11 +1010,11 @@ static void *copy_array(void *dst, const void *src, size_t n, size_t size, gfp_t
 	if (unlikely(check_mul_overflow(n, size, &bytes)))
 		return NULL;
 
-	if (ksize(dst) < ksize(src)) {
-		kfree(dst);
-		dst = kmalloc_track_caller(kmalloc_size_roundup(bytes), flags);
-		if (!dst)
-			return NULL;
+	alloc_bytes = max(ksize(orig), kmalloc_size_roundup(bytes));
+	dst = krealloc(orig, alloc_bytes, flags);
+	if (!dst) {
+		kfree(orig);
+		return NULL;
 	}
 
 	memcpy(dst, src, bytes);