> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index d84af3719..01a99e3a3 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
[ ... ]
> diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
> index 1eeb31c5b..67e9e811d 100644
> --- a/kernel/bpf/arraymap.c
> +++ b/kernel/bpf/arraymap.c
[ ... ]
> @@ -398,10 +405,11 @@ int bpf_percpu_array_update(struct bpf_map *map, void
> *key, void *value,
> struct bpf_array *array = container_of(map, struct bpf_array, map);
> u32 index = *(u32 *)key;
> void __percpu *pptr;
> - int cpu, off = 0;
> + void *ptr, *val;
> u32 size;
> + int cpu;
>
> - if (unlikely(map_flags > BPF_EXIST))
> + if (unlikely((map_flags & BPF_F_LOCK) || (u32)map_flags >
> BPF_F_ALL_CPUS))
> /* unknown flags */
> return -EINVAL;
>
> @@ -409,7 +417,7 @@ int bpf_percpu_array_update(struct bpf_map *map, void
> *key, void *value,
> /* all elements were pre-allocated, cannot insert a new one */
> return -E2BIG;
>
> - if (unlikely(map_flags & BPF_NOEXIST))
> + if (unlikely(map_flags == BPF_NOEXIST))
^^
Does changing this from bitwise-AND to equality break flag combination
handling? The old code checked (map_flags & BPF_NOEXIST), which would
trigger for any flag combination including BPF_NOEXIST. The new code only
checks (map_flags == BPF_NOEXIST), so if userspace passes
(BPF_F_CPU | BPF_NOEXIST), the BPF_NOEXIST flag gets silently ignored
instead of returning -EEXIST as before.
While all elements in percpu_array maps are pre-allocated and BPF_NOEXIST
should always fail anyway, silently ignoring a flag the user explicitly set
seems inconsistent with the principle of rejecting invalid flag combinations
at validation time.
> /* all elements already exist */
> return -EEXIST;
>
[ ... ]
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/19708012130
