[PATCH bpf v2 0/2] bpf: Fix queue/stack map u32 index overflow

From: Yuan Chen <[email protected]>

The queue/stack map addresses elements[] with the product of a u32
head/tail index and value_size, but the storage itself is allocated in
64-bit arithmetic. When max_entries * value_size exceeds U32_MAX, the
product wraps and push/peek/pop operate on the wrong element. Patch 1
restores the dropped bound check; patch 2 adds a regression test.

Changes in v2:
  - Also reject max_entries == U32_MAX: the u32 capacity counter
    qs->size (max_entries + 1) would wrap to 0 and permanently break
    the map, as pointed out in review.
  - Fix the multi-line comment style in the selftest, as pointed out in
    review.

Yuan Chen (2):
  bpf: Fix queue/stack map u32 index overflow
  selftests/bpf: Add regression test for queue/stack map size limit

 kernel/bpf/queue_stack_maps.c                 | 10 +++++
 .../bpf/prog_tests/queue_stack_map.c          | 45 +++++++++++++++++++
 2 files changed, 55 insertions(+)

-- 
2.54.0