[PATCH bpf v3 0/2] bpf: Fix queue/stack map u32 index overflow

From: Yuan Chen <[email protected]>

The queue/stack map addresses elements[] with the product of a u32
head/tail index and value_size, but the storage itself is allocated in
64-bit arithmetic. When max_entries * value_size exceeds U32_MAX, the
product wraps and push/peek/pop operate on the wrong element. Patch 1
restores the dropped bound check; patch 2 adds a regression test.

Changes in v3:
  - Fix the Fixes tag: the bound check was removed by a37fb7ef24a4
    (which dropped the bpf_map_charge_init() call), not by
    c85d69135a91 (which moved the check into bpf_map_charge_init()),
    as pointed out in review. Add Cc: [email protected] since the
    bug affects v5.11+.
  - Define U32_MAX locally in the selftest, as pointed out in review.

Changes in v2:
  - Also reject max_entries == U32_MAX: the u32 capacity counter
    qs->size (max_entries + 1) would wrap to 0 and permanently break
    the map, as pointed out in review.
  - Fix the multi-line comment style in the selftest, as pointed out in
    review.

Yuan Chen (2):
  bpf: Fix queue/stack map u32 index overflow
  selftests/bpf: Add regression test for queue/stack map size limit

 kernel/bpf/queue_stack_maps.c                 | 10 ++++
 .../bpf/prog_tests/queue_stack_map.c          | 49 +++++++++++++++++++
 2 files changed, 59 insertions(+)

-- 
2.54.0