[PATCH bpf-next v3 1/3] bpf: Check tail zero of bpf_map_info

[Leon Hwang]

Since there're 4 bytes padding at the end of struct bpf_map_info, they
won't be checked by bpf_check_uarg_tail_zero().

pahole -C bpf_map_info ./vmlinux
struct bpf_map_info {
        ...
        __u64                      hash __attribute__((__aligned__(8))); /*    
88     8 */
        __u32                      hash_size;            /*    96     4 */

        /* size: 104, cachelines: 2, members: 18 */
        /* padding: 4 */
        /* forced alignments: 1 */
        /* last cacheline: 40 bytes */
} __attribute__((__aligned__(8)));

If a future kernel extension adds a new 4-byte field, older userspace
programs allocating this structure on the stack might inadvertently pass
uninitialized stack garbage into the new field, permanently breaking
backward compatibility. -- sashiko [1]

Fix it by changing sizeof(info) to
offsetofend(struct bpf_map_info, hash_size).

And, add "__u32 :32" to the tail of struct bpf_map_info.

[1] https://lore.kernel.org/bpf/20260513224823.6494fc19...@smtp.kernel.org/

Fixes: ea2e6467ac36 ("bpf: Return hashes of maps in BPF_OBJ_GET_INFO_BY_FD")
Acked-by: Mykyta Yatsenko <yatse...@meta.com>
Signed-off-by: Leon Hwang <leon.hw...@linux.dev>
---
 include/uapi/linux/bpf.h       | 1 +
 kernel/bpf/syscall.c           | 5 +++--
 tools/include/uapi/linux/bpf.h | 1 +
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index bed9b1b4d5ef..e1730f449d9e 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -6733,6 +6733,7 @@ struct bpf_map_info {
        __u64 map_extra;
        __aligned_u64 hash;
        __u32 hash_size;
+       __u32 :32;
 } __attribute__((aligned(8)));
 
 struct bpf_btf_info {
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 31a3b70a0b5d..89f020a44fc9 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -5406,10 +5406,11 @@ static int bpf_map_get_info_by_fd(struct file *file,
 {
        struct bpf_map_info __user *uinfo = u64_to_user_ptr(attr->info.info);
        struct bpf_map_info info;
-       u32 info_len = attr->info.info_len;
+       u32 info_len = attr->info.info_len, len;
        int err;
 
-       err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), sizeof(info), 
info_len);
+       len = offsetofend(struct bpf_map_info, hash_size);
+       err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), len, info_len);
        if (err)
                return err;
        info_len = min_t(u32, sizeof(info), info_len);
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 7d0b282ba674..7caf667e86fe 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -6733,6 +6733,7 @@ struct bpf_map_info {
        __u64 map_extra;
        __aligned_u64 hash;
        __u32 hash_size;
+       __u32 :32;
 } __attribute__((aligned(8)));
 
 struct bpf_btf_info {
-- 
2.54.0