en Copyright 2015 Java http://kernelsources.org:8080/source/history/linux/tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c#f0e77c598ebbb1ae055b156aaa33b7433ae45e51 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfPull bpf fixes from Alexei Starovoitov: - Fix bpf_throw() and global subprog combination (Kumar Kartikeya Dwivedi) - Fix out of bounds access in BPF interpreter (Yazhou Tang) - Fix potential out of bounds access in inner per-cpu array map (Guannan Wang) - Reject NULL data/sig in bpf_verify_pkcs7_signature (KP Singh)* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: libbpf: fix off-by-one in emit_signature_match jump offset bpf: Reject NULL data/sig in bpf_verify_pkcs7_signature selftests/bpf: Cover global subprog exception leaks bpf: Check global subprog exception paths bpf: make bpf_session_is_return() reference optional bpf: Use array_map_meta_equal for percpu array inner map replacement selftests/bpf: Add test for large offset bpf-to-bpf call bpf: Fix s16 truncation for large bpf-to-bpf call offsets bpf: Fix out-of-bounds read in bpf_patch_call_args() List of files: /linux/tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c Sun, 24 May 2026 18:53:17 +0200 Linus Torvalds <torvalds@linux-foundation.org> http://kernelsources.org:8080/source/history/linux/tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c#593980175389a05793f6060aa20e626330960395 bpf: Use array_map_meta_equal for percpu array inner map replacementpercpu_array_map_ops.map_meta_equal points to the genericbpf_map_meta_equal(), which does not compare max_entries. When apercpu array serves as an inner map, replacing it with one that hasfewer max_entries bypasses the check. Since percpu_array_map_gen_lookup()inlines the original template's index_mask as a JIT immediate, a lookupon the replacement map can access pptrs[] out of bounds.Point percpu_array_map_ops.map_meta_equal to array_map_meta_equal(),which already enforces the max_entries equality check.Add a selftest to verify that replacing a percpu array inner map witha differently-sized one is rejected.Fixes: db69718b8efa ("bpf: inline bpf_map_lookup_elem() for PERCPU_ARRAY maps")Signed-off-by: Guannan Wang <wgnbuaa@gmail.com>Acked-by: Mykyta Yatsenko <yatsenko@meta.com>Link: https://lore.kernel.org/r/20260514074454.77491-1-wgnbuaa@gmail.comSigned-off-by: Alexei Starovoitov <ast@kernel.org> List of files: /linux/tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c Thu, 14 May 2026 09:44:54 +0200 Guannan Wang <wgnbuaa@gmail.com>