Puranjay Mohan 31d3b4b28e bpf: Validate node_id in arena_alloc_pages() ...

[ Upstream commit 2845989f2e ]

arena_alloc_pages() accepts a plain int node_id and forwards it through
the entire allocation chain without any bounds checking.

Validate node_id before passing it down the allocation chain in
arena_alloc_pages().

Fixes: 317460317a ("bpf: Introduce bpf_arena.")
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/r/20260417152135.1383754-1-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-05-23 13:04:42 +02:00

..

bpf

bpf: Validate node_id in arena_alloc_pages()

2026-05-23 13:04:42 +02:00

cgroup

cgroup: fix race between task migration and iteration

2026-03-25 11:08:30 +01:00

configs

Remove WARN_ALL_UNSEEDED_RANDOM kernel config option

2026-03-04 07:21:32 -05:00

debug

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

dma

dma: swiotlb: add KMSAN annotations to swiotlb_bounce()

2026-04-02 13:09:31 +02:00

entry

…

events

fdget(), trivial conversions

2026-05-23 13:04:35 +02:00

futex

futex: Require sys_futex_requeue() to have identical flags

2026-04-02 13:09:54 +02:00

gcov

gcov: add support for GCC 15

2025-11-24 10:35:59 +01:00

irq

kexec: Consolidate machine_kexec_mask_interrupts() implementation

2026-03-25 11:08:25 +01:00

kcsan

kcsan: test: Initialize dummy variable

2025-08-15 12:13:46 +02:00

livepatch

livepatch: Match old_sympos 0 and 1 in klp_find_func()

2026-01-08 10:13:56 +01:00

locking

rtmutex: Use waiter::task instead of current in remove_waiter()

2026-05-07 06:09:43 +02:00

module

module: Fix freeing of charp module parameters when CONFIG_SYSFS=n

2026-05-23 13:04:21 +02:00

power

PM: hibernate: Drain trailing zero pages on userspace restore

2026-04-02 13:09:39 +02:00

printk

printk: nbcon: Allow reacquire during panic

2025-08-20 18:30:47 +02:00

rcu

rcu: Fix rcu_read_unlock() deadloop due to softirq

2026-03-04 07:19:21 -05:00

sched

sched: Use u64 for bandwidth ratio calculations

2026-05-07 06:09:30 +02:00

time

hrtimer: Reduce trace noise in hrtimer_start()

2026-05-23 13:04:21 +02:00

trace

tracing: Rebuild full_name on each hist_field_name() call

2026-05-23 13:04:40 +02:00

.gitignore

…

acct.c

acct: block access to kernel internal filesystems

2025-02-27 04:30:23 -08:00

async.c

…

audit_fsnotify.c

…

audit_tree.c

…

audit_watch.c

…

audit.c

audit: Make use of str_enabled_disabled() helper

2024-09-03 16:35:16 -04:00

audit.h

audit,module: restore audit logging in load failure case

2025-08-15 12:13:31 +02:00

auditfilter.c

audit: use task_tgid_nr() instead of task_pid_nr()

2024-08-28 16:48:28 -04:00

auditsc.c

audit,module: restore audit logging in load failure case

2025-08-15 12:13:31 +02:00

backtracetest.c

…

bounds.c

…

capability.c

…

cfi.c

…

compat.c

…

configs.c

…

context_tracking.c

…

cpu_pm.c

…

cpu.c

watchdog/hardlockup/perf: Fix perf_event memory leak

2025-04-10 14:39:11 +02:00

crash_core.c

crash: fix crashkernel resource shrink

2025-11-24 10:36:01 +01:00

crash_reserve.c

crash: fix crash memory reserve exceed system memory bug

2024-09-01 20:43:30 -07:00

cred.c

…

delayacct.c

…

dma.c

…

elfcorehdr.c

…

exec_domain.c

…

exit.c

ptrace: slightly saner 'get_dumpable()' logic

2026-05-15 14:51:08 +02:00

exit.h

…

extable.c

…

fail_function.c

…

fork.c

unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure

2026-05-23 13:04:39 +02:00

freezer.c

sched,freezer: Remove unnecessary warning in __thaw_task

2025-07-24 08:56:37 +02:00

gen_kheaders.sh

kheaders: Ignore silly-rename files

2025-01-23 17:22:55 +01:00

groups.c

…

hung_task.c

…

iomem.c

…

irq_work.c

…

jump_label.c

jump_label: Fix static_key_slow_dec() yet again

2024-09-10 11:57:27 +02:00

kallsyms_internal.h

…

kallsyms_selftest.c

…

kallsyms_selftest.h

…

kallsyms.c

kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()

2026-03-04 07:20:02 -05:00

kcmp.c

…

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.kexec

crash, powerpc: default to CRASH_DUMP=n on PPC_BOOK3S_32

2024-11-14 22:43:48 -08:00

Kconfig.locks

…

Kconfig.preempt

…

kcov.c

kcov: mark in_softirq_really() as __always_inline

2025-01-09 13:33:49 +01:00

kexec_core.c

kexec: define functions to map and unmap segments

2026-03-13 17:20:27 +01:00

kexec_elf.c

kexec: initialize ELF lowest address to ULONG_MAX

2025-04-10 14:39:24 +02:00

kexec_file.c

kexec: derive purgatory entry from symbol

2026-03-04 07:21:51 -05:00

kexec_internal.h

kexec: use atomic_try_cmpxchg_acquire() in kexec_trylock()

2024-09-01 20:43:23 -07:00

kexec.c

…

kheaders.c

…

kprobes.c

kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()

2026-03-25 11:08:48 +01:00

ksyms_common.c

…

ksysfs.c

…

kthread.c

kthread: unpark only parked kthread

2024-10-09 12:47:19 -07:00

latencytop.c

…

Makefile

mm: move kernel/numa.c to mm/

2024-09-03 21:15:26 -07:00

module_signature.c

…

notifier.c

…

nsproxy.c

fdget(), trivial conversions

2026-05-23 13:04:35 +02:00

padata.c

padata: Put CPU offline callback in ONLINE section to allow failure

2026-05-23 13:04:29 +02:00

panic.c

objtool, panic: Disable SMAP in __stack_chk_fail()

2025-05-02 07:59:19 +02:00

params.c

module: Fix freeing of charp module parameters when CONFIG_SYSFS=n

2026-05-23 13:04:21 +02:00

pid_namespace.c

…

pid_sysctl.h

…

pid.c

fdget(), trivial conversions

2026-05-23 13:04:35 +02:00

profile.c

…

ptrace.c

ptrace: slightly saner 'get_dumpable()' logic

2026-05-15 14:51:08 +02:00

range.c

…

reboot.c

Flush console log from kernel_power_off()

2025-04-20 10:15:12 +02:00

regset.c

…

relay.c

[tree-wide] finally take no_llseek out

2024-09-27 08:18:43 -07:00

resource_kunit.c

resource, kunit: fix user-after-free in resource_test_region_intersects()

2024-10-09 12:47:19 -07:00

resource.c

Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"

2025-12-18 13:55:11 +01:00

rseq.c

rseq: Clarify rseq registration rseq_size bound check comment

2026-03-13 17:20:17 +01:00

scftorture.c

…

scs.c

scs: fix a wrong parameter in __scs_magic

2026-01-08 10:14:21 +01:00

seccomp.c

seccomp: passthrough uprobe systemcall without filtering

2025-11-02 22:15:20 +09:00

signal.c

pidfs: improve multi-threaded exec and premature thread-group leader exit polling

2025-05-29 11:02:09 +02:00

smp.c

smp: Fix up and expand the smp_call_function_many() kerneldoc

2025-10-15 12:00:02 +02:00

smpboot.c

…

smpboot.h

…

softirq.c

lockdep: Fix wait context check on softirq for PREEMPT_RT

2025-05-29 11:02:08 +02:00

stackleak.c

…

stacktrace.c

…

static_call_inline.c

x86/static-call: provide a way to do very early static-call updates

2024-12-19 18:13:23 +01:00

static_call.c

…

stop_machine.c

sched/core: Fix migrate_swap() vs. hotplug

2025-07-17 18:37:03 +02:00

sys_ni.c

…

sys.c

fdget(), trivial conversions

2026-05-23 13:04:35 +02:00

sysctl-test.c

…

sysctl.c

sysctl: fix uninitialized variable in proc_do_large_bitmap

2026-04-02 13:09:40 +02:00

task_work.c

task_work: Fix NMI race condition

2025-12-18 13:54:50 +01:00

taskstats.c

taskstats: set version in TGID exit notifications

2026-05-07 06:09:40 +02:00

torture.c

…

tracepoint.c

tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()

2026-05-14 15:29:29 +02:00

tsacct.c

…

ucount.c

ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()

2026-03-04 07:20:08 -05:00

uid16.c

…

uid16.h

…

umh.c

…

up.c

…

user_namespace.c

user_namespace: use kmemdup_array() instead of kmemdup() for multiple allocation

2024-09-09 16:47:42 -07:00

user-return-notifier.c

…

user.c

uidgid: make sure we fit into one cacheline

2024-09-12 12:16:09 +02:00

usermode_driver.c

…

utsname_sysctl.c

…

utsname.c

…

vhost_task.c

vhost: Take a reference on the task in struct vhost_task.

2025-10-02 13:44:10 +02:00

vmcore_info.c

mm: support only one page_type per page

2024-09-03 21:15:43 -07:00

watch_queue.c

fdget(), trivial conversions

2026-05-23 13:04:35 +02:00

watchdog_buddy.c

…

watchdog_perf.c

watchdog/hardlockup/perf: Fix perf_event memory leak

2025-04-10 14:39:11 +02:00

watchdog.c

watchdog/softlockup: fix sample ring index wrap in need_counting_irqs()

2026-03-04 07:21:54 -05:00

workqueue_internal.h

…

workqueue.c

workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works

2026-04-18 10:41:56 +02:00