Re: [PATCH v2] bpf-next: Prevent out of bound buffer write in __bpf_get_stack
From: bot+bpf-ci@kernel.org
Date: 2026-01-07 18:31:40
Also in:
bpf, lkml
quoted hunk ↗ jump to hunk
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index da3d328f5c15..c0a430f9eafb 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c@@ -465,7 +465,6 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, if (trace_in) { trace = trace_in; - trace->nr = min_t(u32, trace->nr, max_depth); } else if (kernel && task) { trace = get_callchain_entry_for_task(task, max_depth); } else {@@ -473,13 +472,15 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, crosstask, false, 0); } + trace_nr = min(trace->nr, max_depth);
^^^^^^^^ Can this dereference trace when it is NULL? Both get_callchain_entry_for_task() and get_perf_callchain() can return NULL, and several callers pass trace_in as NULL (bpf_get_stack, bpf_get_stack_sleepable, __bpf_get_task_stack, and one path in bpf_get_stack_pe). The NULL check below comes after this dereference:
+
+ if (unlikely(!trace) || trace_nr < skip) {^^^^^^ This check is now ineffective because trace->nr was already dereferenced above. [ ... ] --- AI reviewed your patch. Please fix the bug or email reply why it's not a bug. See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md CI run summary: https://github.com/kernel-patches/bpf/actions/runs/20791981532