Merge branch 'bpf-fix-queue-stack-map-u32-index-overflow'
Yuan Chen says:
====================
bpf: Fix queue/stack map u32 index overflow
From: Yuan Chen <chenyuan@kylinos.cn>
This series fixes an integer overflow in BPF queue/stack maps. The u32
head/tail index is multiplied by value_size to address elements[], but
the storage itself is allocated with 64-bit arithmetic. When
max_entries * value_size reaches or exceeds U32_MAX, the index
multiplication wraps and push/peek/pop operate on the wrong element,
corrupting map data and leaking stale values to user space.
max_entries == U32_MAX would also wrap the u32 capacity counter
qs->size (max_entries + 1) to 0 and permanently break the map.
Patch 1 restores the size bound in queue_stack_map_alloc_check() that
was lost when the check inside bpf_map_charge_init() was removed. A
single division-based comparison covers both the index multiplication
overflow and the capacity counter wrap.
Patch 2 adds a regression test for both rejection cases.
v2 -> v3:
- also reject max_entries == U32_MAX, which would wrap the u32
capacity counter qs->size (max_entries + 1) to 0
- fix the Fixes tag: the guard was actually dropped by a37fb7ef24a4,
which removed the bpf_map_charge_init() call the check had been
moved into by c85d69135a91
v3 -> v4:
- simplify the bound to a single `max_entries >= U32_MAX /
value_size` comparison, which also rejects max_entries == U32_MAX
- check the bpf_map_create() return value directly instead of errno
in the selftest
v4 -> v5:
- drop the explanatory comment in queue_stack_map_alloc_check()
- selftest: drop the unused bpf_map_create_opts, inline the 1MB value
size, close the fd if bpf_map_create() unexpectedly returns a valid
fd, and drop the verbose comments
====================
Link: https://patch.msgid.link/20260831063226.621309-1-chenyuan_fl@163.com
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>