[PATCH bpf] bpf: Fix out-of-bounds read in bpf_obj_memcpy

[Jiayuan Chen]

When copying map value between two maps in BPF program, an out-of-bounds
read can occur in bpf_obj_memcpy(). Consider the following scenario:
    // map1: BPF_MAP_TYPE_CGROUP_STORAGE, value_size = 4
    // map2: BPF_MAP_TYPE_LRU_PERCPU_HASH, value_size = 4
    void *src = bpf_get_local_storage(&map1, 0);  // 4-byte buffer
    bpf_map_update_elem(&map2, &key, src, 0);     // copy src to map2

The verifier validates that source buffer size >= destination map's
value_size through check_helper_mem_access(). Since both maps have
value_size=4, verification passes.

However, at runtime bpf_obj_memcpy() rounds up the copy size to 8 bytes
for long-aligned atomic copy:
    bpf_long_memcpy(dst, src, round_up(size, 8));  // reads 8 bytes

This causes a 4-byte over-read from the source buffer. Fix this by using
round_down() to only copy complete 8-byte chunks with bpf_long_memcpy(),
then copy any remaining bytes with regular memcpy().

This ensures we never read beyond the validated buffer size while still
maintaining atomic operations where possible.

Fixes: d3bec0138bfbe ("bpf: Zero-fill re-used per-cpu map element")
Closes: https://lore.kernel.org/bpf/14e6c70c.6c121.19c0399d948.Coremail.kaiyanm@xxxxxxxxxxx/
Reported-by: Kaiyan Mei <M202472210@xxxxxxxxxxx>
Reported-by: Yinhao Hu <dddddd@xxxxxxxxxxx>
Reviewed-by: Dongliang Mu <dzm91@xxxxxxxxxxx>
Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
---
 include/linux/bpf.h | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 05b34a6355b03..1b789f9f8a095 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -535,10 +535,15 @@ static inline void bpf_obj_memcpy(struct btf_record *rec,
 	int i;
 
 	if (IS_ERR_OR_NULL(rec)) {
-		if (long_memcpy)
-			bpf_long_memcpy(dst, src, round_up(size, 8));
-		else
+		u32 aligned = round_down(size, 8);
+
+		if (long_memcpy && aligned) {
+			bpf_long_memcpy(dst, src, aligned);
+			if (size > aligned)
+				memcpy(dst + aligned, src + aligned, size - aligned);
+		} else {
 			memcpy(dst, src, size);
+		}
 		return;
 	}
 
-- 
2.43.0