)]}'
{
  "commit": "11c1e836710dcba03e50454a4eedfdbaf8d3050e",
  "tree": "34a9f60fef762dffa12fb14066fefa77a041e328",
  "parents": [
    "9f04670efab1311ea57d8422a5db5f43e4765ee9"
  ],
  "author": {
    "name": "Jérémy Jean",
    "email": "Jeremy.Jean@oss.cyber.gouv.fr",
    "time": "Wed Aug 05 06:02:28 2026 +0000"
  },
  "committer": {
    "name": "Andrii Nakryiko",
    "email": "andrii@kernel.org",
    "time": "Wed Aug 05 11:45:20 2026 -0700"
  },
  "message": "bpf: Harden bloom filter sizing and indexing on 32-bit kernels\n\nbloom_map_alloc() has two 32-bit-specific problems when the computed\nbitmap reaches the U32_MAX fallback case.\n\nFirst, BITS_TO_BYTES(U32_MAX) is evaluated with 32-bit arithmetic. The\naddition performed by DIV_ROUND_UP wraps, so the map allocates only the\nfixed-size bloom filter object while keeping bitset_mask \u003d\u003d U32_MAX.\nSubsequent updates can then write past the allocated object.\n\nSecond, fixing only the allocation size is not sufficient. The bloom hash\nis a u32, but set_bit() takes a signed long bit number and x86 test_bit()\neventually feeds the index to variable_test_bit(long, ...). On 32-bit\nkernels, hashes in [0x80000000, U32_MAX] therefore become negative bit\noffsets. x86 bt/bts with a memory operand interpret those offsets relative\nto the supplied base, so a map with bitset_mask \u003d\u003d U32_MAX can read or\nwrite before bloom-\u003ebitset even after allocating the full 512 MiB bitmap.\n\nKeep the U32_MAX fallback, but split each hash into a word pointer and an\nin-word bit number before calling test_bit() or set_bit(). The bitops\nargument is then always in [0, BITS_PER_LONG - 1], while BIT_WORD(h) still\nselects the intended word in the full bitmap.\n\nCompute the bitset size from (u64)bitset_mask + 1 before passing the final\nsize to bpf_map_area_alloc(). This fixes the original under-allocation and\nkeeps the allocated storage consistent with the addressable bitset.\n\nExploitation note: local privilege escalation is possible on a 32-bit x86\nkernel using the under-allocation bug from a binary with CAP_BPF.\n\nFixes: 9330986c0300 (\"bpf: Add bloom filter map implementation\")\nSigned-off-by: Jérémy Jean \u003cJeremy.Jean@oss.cyber.gouv.fr\u003e\nSigned-off-by: Andrii Nakryiko \u003candrii@kernel.org\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/bpf/20260805060228.2703051-1-Jeremy.Jean@oss.cyber.gouv.fr\n\nAssisted-by: Codex:gpt-5\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b73336c976b7c3799798a4147bc3f7e2a776d99c",
      "old_mode": 33188,
      "old_path": "kernel/bpf/bloom_filter.c",
      "new_id": "c6e7559b07de0e10b641118a156b7a6da9bab582",
      "new_mode": 33188,
      "new_path": "kernel/bpf/bloom_filter.c"
    }
  ]
}