Re: [PATCH bpf 1/1] xsk: use a 32-bit compare in xsk_map_gen_lookup
flat view
From: Emil Tsalapatis <hidden>
Date: 2026-09-14 22:35:45
Also in:
bpf
On Thu, Sep 10, 2026 at 5:07 PM Zhiling Zou [off-list ref] wrote:
xsk_map_gen_lookup() loads a u32 key and compares it with max_entries
using BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a
max_entries value of 0x80000000 or higher becomes a threshold larger
than every zero-extended 32-bit key. An out-of-range index then skips
the bounds check and the generated lookup reads past xsk_map[].
Compare with BPF_JMP32_IMM so the check stays in 32-bit unsigned range.
Fixes: e65650f291ee ("bpf: Implement map_gen_lookup() callback for XSKMAP")
Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>
Signed-off-by: Zhiling Zou <redacted>
---Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> For xskmap specifically this scenario is pretty unlikely, so this could also go through bpf-next. Feel free to follow up on Sashiko's feedback, but they qualify as followup work and shouldn't block us from merging this.
quoted hunk ↗ jump to hunk
net/xdp/xskmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/net/xdp/xskmap.c b/net/xdp/xskmap.c index 3bff346308d0f..bf00d6463c191 100644 --- a/net/xdp/xskmap.c +++ b/net/xdp/xskmap.c@@ -124,7 +124,7 @@ static int xsk_map_gen_lookup(struct bpf_map *map, struct bpf_insn *insn_buf) struct bpf_insn *insn = insn_buf; *insn++ = BPF_LDX_MEM(BPF_W, ret, index, 0); - *insn++ = BPF_JMP_IMM(BPF_JGE, ret, map->max_entries, 5); + *insn++ = BPF_JMP32_IMM(BPF_JGE, ret, map->max_entries, 5); *insn++ = BPF_ALU64_IMM(BPF_LSH, ret, ilog2(sizeof(struct xsk_sock *))); *insn++ = BPF_ALU64_IMM(BPF_ADD, mp, offsetof(struct xsk_map, xsk_map)); *insn++ = BPF_ALU64_REG(BPF_ADD, ret, mp); --2.43.0