On 5/18/26 3:54 PM, Leon Hwang wrote:
> Because of the 8-byte alignment, the compiler will pad struct
> bpf_common_attr to 24 bytes. That said, sizeof(attr_common) is 24 instead
> of 20.
>
> When check tail zero using sizeof(attr_common) in
> bpf_check_uarg_tail_zero(), there will be 4 bytes that won't be checked.
>
> To also check the padding 4 bytes, replace sizeof(attr_common) with
> offsetofend(struct bpf_common_attr, log_true_size).
>
> Fixes: f28771c0691b ("bpf: Extend BPF syscall with common attributes support")
> Signed-off-by: Leon Hwang <[email protected]>
> ---
> kernel/bpf/syscall.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 6600e126fbfb..83de8fb9b9aa 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -6278,7 +6278,9 @@ static int __sys_bpf(enum bpf_cmd cmd, bpfptr_t uattr,
> unsigned int size,
>
> memset(&attr_common, 0, sizeof(attr_common));
> if (cmd & BPF_COMMON_ATTRS) {
> - err = bpf_check_uarg_tail_zero(uattr_common,
> sizeof(attr_common), size_common);
> + err = bpf_check_uarg_tail_zero(uattr_common,
> + offsetofend(struct
> bpf_common_attr, log_true_size),
> + size_common);
The change looks correct.
It looks like similar behavior exists in 2 other places of this file:
bpf_map_get_info_by_fd()
bpf_prog_get_info_by_fd()
Does it make sense to fix those too, just to make sure agents follow the
pattern correctly next time?
> if (err)
> return err;
>
