// SPDX-License-Identifier: GPL-2.0 #include <linux/bpf.h> #include <bpf/bpf_helpers.h> struct { __uint(type, BPF_MAP_TYPE_CGROUP_STORAGE); __type(key, struct bpf_cgroup_storage_key); __type(value, __u64); } cgroup_storage SEC(".maps"); SEC("cgroup_skb/egress") int bpf_prog(struct __sk_buff *skb) { __u64 *counter; counter = bpf_get_local_storage(&cgroup_storage, 0); __sync_fetch_and_add(counter, 1); /* Drop one out of every two packets */ return (*counter & 1); } /* Maps for OOB test */ struct { __uint(type, BPF_MAP_TYPE_CGROUP_STORAGE); __type(key, struct bpf_cgroup_storage_key); __type(value, __u32); /* 4-byte value - not 8-byte aligned */ } cgroup_storage_oob SEC(".maps"); struct { __uint(type, BPF_MAP_TYPE_LRU_PERCPU_HASH); __uint(max_entries, 1); __type(key, __u32); __type(value, __u32); /* 4-byte value - same as cgroup storage */ } lru_map SEC(".maps"); SEC("cgroup/sock_create") int trigger_oob(struct bpf_sock *sk) { __u32 key = 0; __u32 *cgroup_val; __u32 value = 0x12345678; /* Get cgroup storage value */ cgroup_val = bpf_get_local_storage(&cgroup_storage_oob, 0); if (!cgroup_val) return 0; /* Initialize cgroup storage */ *cgroup_val = value; /* This triggers the OOB read: * bpf_map_update_elem() -> htab_map_update_elem() -> * pcpu_init_value() -> copy_map_value_long() -> * bpf_obj_memcpy(..., long_memcpy=true) -> * bpf_long_memcpy(dst, src, round_up(4, 8)) * * The copy size is rounded up to 8 bytes, but cgroup_val * points to a 4-byte buffer, causing a 4-byte OOB read. */ bpf_map_update_elem(&lru_map, &key, cgroup_val, BPF_ANY); return 1; } char _license[] SEC("license") = "GPL";