Puranjay Mohan 31d3b4b28e bpf: Validate node_id in arena_alloc_pages() ...

[ Upstream commit 2845989f2e ]

arena_alloc_pages() accepts a plain int node_id and forwards it through
the entire allocation chain without any bounds checking.

Validate node_id before passing it down the allocation chain in
arena_alloc_pages().

Fixes: 317460317a ("bpf: Introduce bpf_arena.")
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/r/20260417152135.1383754-1-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-05-23 13:04:42 +02:00

..

preload

bpf/preload: Don't select USERMODE_DRIVER

2025-08-15 12:13:48 +02:00

arena.c

bpf: Validate node_id in arena_alloc_pages()

2026-05-23 13:04:42 +02:00

arraymap.c

bpf: Fix RCU stall in bpf_fd_array_map_clear()

2026-05-23 13:04:24 +02:00

bloom_filter.c

…

bpf_cgrp_storage.c

…

bpf_inode_storage.c

…

bpf_iter.c

…

bpf_local_storage.c

…

bpf_lru_list.c

bpf: Adjust free target to avoid global starvation of LRU map

2025-07-17 18:37:22 +02:00

bpf_lru_list.h

bpf: Adjust free target to avoid global starvation of LRU map

2025-07-17 18:37:22 +02:00

bpf_lsm.c

bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks

2026-05-23 13:04:23 +02:00

bpf_struct_ops.c

bpf: Pass the same orig_call value to trampoline functions

2025-06-27 11:11:31 +01:00

bpf_task_storage.c

…

btf_iter.c

…

btf_relocate.c

…

btf.c

bpf: Release module BTF IDR before module unload

2026-04-02 13:09:25 +02:00

cgroup_iter.c

…

cgroup.c

bpf: Reject narrower access to pointer ctx fields

2026-01-23 11:18:50 +01:00

core.c

bpf: Fix stale offload->prog pointer after constant blinding

2026-05-23 13:04:23 +02:00

cpumap.c

…

cpumask.c

…

crypto.c

bpf: crypto: Use the correct destructor kfunc type

2026-03-04 07:20:57 -05:00

devmap.c

bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path

2026-05-23 13:04:22 +02:00

disasm.c

…

disasm.h

…

dispatcher.c

…

hashtab.c

bpf: Fix OOB in pcpu_init_value

2026-05-23 13:04:25 +02:00

helpers.c

bpf: allow UTF-8 literals in bpf_bprintf_prepare()

2026-05-23 13:04:42 +02:00

inode.c

bpf: Avoid RCU context warning when unpinning htab with internal structs

2025-10-19 16:33:43 +02:00

Kconfig

…

link_iter.c

…

local_storage.c

bpf: fix end-of-list detection in cgroup_storage_get_next_key()

2026-05-23 13:04:23 +02:00

log.c

…

lpm_trie.c

…

Makefile

…

map_in_map.c

…

map_in_map.h

…

map_iter.c

…

memalloc.c

…

mmap_unlock_work.h

…

mprog.c

…

net_namespace.c

…

offload.c

…

percpu_freelist.c

…

percpu_freelist.h

…

prog_iter.c

…

queue_stack_maps.c

…

relo_core.c

…

reuseport_array.c

…

ringbuf.c

bpf: Sync pending IRQ work before freeing ring buffer

2025-11-13 15:33:57 -05:00

stackmap.c

bpf: Fix stackmap overflow check in __bpf_get_stackid()

2025-12-18 13:54:50 +01:00

syscall.c

bpf: Fix invalid prog->stats access when update_effective_progs fails

2025-12-18 13:55:00 +01:00

sysfs_btf.c

…

task_iter.c

bpf: return VMA snapshot from task_vma iterator

2026-05-23 13:04:24 +02:00

tcx.c

…

tnum.c

bpf: Use tnums for JEQ/JNE is_branch_taken logic

2025-11-13 15:34:02 -05:00

token.c

…

trampoline.c

bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

2026-03-13 17:20:42 +01:00

verifier.c

bpf: Fix NULL deref in map_kptr_match_type for scalar regs

2026-05-23 13:04:42 +02:00