> commit 3563498ad027820b11bad3993a5c6a17d293ad23 > Author: Hui Su <[email protected]> > > bpf: fix percpu map update indexing with sparse CPU IDs > > Per-CPU array, hash, and cgroup storage map updates without BPF_F_CPU > or BPF_F_ALL_CPUS use a value buffer whose per-CPU slots are packed in > possible-CPU order. The buffer is sized as: > > round_up(value_size, 8) * num_possible_cpus() > > The update paths iterate over possible CPUs, but use the logical CPU ID > to calculate the source offset: > > value + size * cpu > > This only works when possible CPU IDs are contiguous starting at zero. > > For example, with a possible CPU mask of 0,2-3, the buffer contains > three slots corresponding to CPUs 0, 2, and 3. CPU2 is therefore > expected to use slot 1 and CPU3 slot 2. Instead, the current code uses > slots 2 and 3 respectively, causing incorrect per-CPU values and an > out-of-bounds read from the update buffer for CPU3. > > The corresponding lookup paths already use a dense offset while > iterating over possible CPUs. Do the same for the array, hash, and > cgroup storage update paths, advancing the source offset once for each > possible CPU. BPF_F_ALL_CPUS continues to use the same value for every > CPU. > > Fixes: 8eb76cb03f0f ("bpf: Add BPF_F_CPU and BPF_F_ALL_CPUS flags support > for percpu_array maps")
The Fixes: tag points to 8eb76cb03f0f, which introduced the 'value + size * cpu' pattern in bpf_percpu_array_update() (kernel/bpf/arraymap.c). That attribution is correct for the arraymap.c fix. However, at commit 8eb76cb03f0f, kernel/bpf/hashtab.c and kernel/bpf/local_storage.c still used the correct 'off += size' pattern and did not have the 'size * cpu' bug yet. The hashtab.c and local_storage.c bugs were introduced later in the same BPF_F_CPU feature series. Should this commit include additional Fixes: tags for the commits that introduced the bug in hashtab.c and local_storage.c? This would ensure that backporting tools pick up all three fixes even when the percpu_array commit is not present in a given stable tree. --- AI reviewed your patch. Please fix the bug or email reply why it's not a bug. See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31703563365
