pcpu_copy_value() with BPF_F_CPU copies the value only to the target CPU's slot and returns immediately, leaving all other CPUs untouched. When inserting a *new* element, the backing per-CPU area may be reused from bpf_mem_cache or a prealloc freelist without being zero-initialized, so non-target CPUs retain stale contents of a previously-deleted element in the same map — a same-map information disclosure. pcpu_init_value() is used to initialize newly allocated elements, while updates to existing elements call pcpu_copy_value() directly; non-target CPU slots intentionally retain their previous values there. The onallcpus=false path in pcpu_init_value() already handles new element initialization correctly by explicitly zeroing non-current CPUs: if (cpu == current_cpu) copy_map_value(..., value); else zero_map_value(...); Fix by adding a zero-fill pass in pcpu_init_value() after pcpu_copy_value() returns, covering only the BPF_F_CPU new-element path: iterate all CPUs and zero-fill every slot except the target. This leaves pcpu_copy_value() unchanged so the update-existing-element semantics are not affected. Fixes: c6936161fd55 ("bpf: Add BPF_F_CPU and BPF_F_ALL_CPUS flags support for percpu_hash and lru_percpu_hash maps") Signed-off-by: Ömer Mete Kaya --- Tested with a reproducer: - Before the fix: CPU 1 retained 0xDEADBEEFCAFEBABE from the deleted element. - After the fix: the non-target CPU read back zero. kernel/bpf/hashtab.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index 8cc07e54daaa..dff4321f2828 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -1099,6 +1099,16 @@ static void pcpu_init_value(struct bpf_htab *htab, void __percpu *pptr, } } else { pcpu_copy_value(htab, pptr, value, onallcpus, map_flags); + if (map_flags & BPF_F_CPU) { + int target = map_flags >> 32; + int cpu; + + for_each_possible_cpu(cpu) { + if (cpu != target) + zero_map_value(&htab->map, + per_cpu_ptr(pptr, cpu)); + } + } } } -- 2.55.0