)]}'
{
  "commit": "f78099c0b875bbde12fadb1e7579e5760f80dd3b",
  "tree": "631ca42e766b96409ffb640442c0e935f7c1894d",
  "parents": [
    "0dc42e73fa05c12277544b99c5d5d9b4c04118e4"
  ],
  "author": {
    "name": "He Gao",
    "email": "hegao@google.com",
    "time": "Mon Aug 18 23:07:35 2025 +0000"
  },
  "committer": {
    "name": "Robert Kolchmeyer",
    "email": "rkolchmeyer@google.com",
    "time": "Thu Aug 21 14:44:42 2025 -0700"
  },
  "message": "bpf: Fix oob access in cgroup local storage\n\nupstream commit: abad3d0bad72a52137e0c350c59542d75ae4f513\n\nLonial reported that an out-of-bounds access in cgroup local storage\ncan be crafted via tail calls. Given two programs each utilizing a\ncgroup local storage with a different value size, and one program\ndoing a tail call into the other. The verifier will validate each of\nthe indivial programs just fine. However, in the runtime context\nthe bpf_cg_run_ctx holds an bpf_prog_array_item which contains the\nBPF program as well as any cgroup local storage flavor the program\nuses. Helpers such as bpf_get_local_storage() pick this up from the\nruntime context:\n\n  ctx \u003d container_of(current-\u003ebpf_ctx, struct bpf_cg_run_ctx, run_ctx);\n  storage \u003d ctx-\u003eprog_item-\u003ecgroup_storage[stype];\n\n  if (stype \u003d\u003d BPF_CGROUP_STORAGE_SHARED)\n    ptr \u003d \u0026READ_ONCE(storage-\u003ebuf)-\u003edata[0];\n  else\n    ptr \u003d this_cpu_ptr(storage-\u003epercpu_buf);\n\nFor the second program which was called from the originally attached\none, this means bpf_get_local_storage() will pick up the former\nprogram\u0027s map, not its own. With mismatching sizes, this can result\nin an unintended out-of-bounds access.\n\nTo fix this issue, we need to extend bpf_map_owner with an array of\nstorage_cookie[] to match on i) the exact maps from the original\nprogram if the second program was using bpf_get_local_storage(), or\nii) allow the tail call combination if the second program was not\nusing any of the cgroup local storage maps.\n\nBUG\u003db/438183338\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed KCTF-abad3d0 in the Linux kernel.\n\ncos-patch: security-high\nFixes: 7d9c3427894f (\"bpf: Make cgroup storages shared between programs on the same cgroup\")\nReported-by: Lonial Con \u003ckongln9170@gmail.com\u003e\nChange-Id: I45c640efd76cd59ed38d8d6e58d295020bac6bb2\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/109192\nReviewed-by: Miri Amarilio \u003cmirilio@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nMain-Branch-Verified: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/109268\nTested-by: He Gao \u003chegao@google.com\u003e\nReviewed-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b8e02049928576c0f03feeb74cb7ddfeff414c15",
      "old_mode": 33188,
      "old_path": "include/linux/bpf.h",
      "new_id": "83da9c81fa86ad3c4e9e15ec5dc92a9a2545989f",
      "new_mode": 33188,
      "new_path": "include/linux/bpf.h"
    },
    {
      "type": "modify",
      "old_id": "c3369c66eae8f8f25278a7a1ea79bb64bc637ac8",
      "old_mode": 33188,
      "old_path": "kernel/bpf/core.c",
      "new_id": "3618be05fc352768f8d684904885c9ed96f747b2",
      "new_mode": 33188,
      "new_path": "kernel/bpf/core.c"
    }
  ]
}