bpf_arena_free_pages() accepts scalar arena addresses. The free path masks the low 32 bits, computes the full user address, and clips only against arena->user_vm_end before inserting the range into the arena free range tree.
A scalar address below arena->user_vm_start can therefore produce an out-of-domain page offset. A later allocation can consume that offset from the free range tree and return an address outside the arena range. Reject frees whose computed full address is below the arena start before clipping the end of the range, and add a verifier selftest for the out-of-range free case. Signed-off-by: Nuoqi Gui <[email protected]> --- Nuoqi Gui (2): bpf: Reject out-of-range arena free addresses selftests/bpf: Cover out-of-range arena free addresses kernel/bpf/arena.c | 2 ++ tools/testing/selftests/bpf/progs/verifier_arena.c | 26 ++++++++++++++++++++++ 2 files changed, 28 insertions(+) --- base-commit: 87bfe634b1193db90e5170e1ddbad04a63ef4501 change-id: 20260706-f01-31-arena-free-bpf-next-82bbb5be9bd4 Best regards, -- Nuoqi Gui <[email protected]>
