[PATCH bpf v4 0/2] bpf: Fix queue/stack map u32 index overflow

From: Yuan Chen <[email protected]>

This series fixes an integer overflow in BPF queue/stack maps.  The u32
head/tail index is multiplied by value_size to address elements[], but
the storage itself is allocated with 64-bit arithmetic.  When
max_entries * value_size reaches or exceeds U32_MAX, the index
multiplication wraps and push/peek/pop operate on the wrong element,
corrupting map data and leaking stale values to user space.
max_entries == U32_MAX would also wrap the u32 capacity counter
qs->size (max_entries + 1) to 0 and permanently break the map.

Patch 1 restores the size bound in queue_stack_map_alloc_check() that
was lost when the check inside bpf_map_charge_init() was removed.  A
single division-based comparison covers both the index multiplication
overflow and the capacity counter wrap.

Patch 2 adds a regression test for both rejection cases.

Many thanks to Andrii Nakryiko for the careful review and the helpful
suggestions: the bound has been simplified to a single
`max_entries >= U32_MAX / value_size` check, and the selftest now
asserts the bpf_map_create() return value directly instead of reading
errno.

v2 -> v3:
  - also reject max_entries == U32_MAX, which would wrap the u32
    capacity counter qs->size (max_entries + 1) to 0
  - fix the Fixes tag: the guard was actually dropped by a37fb7ef24a4,
    which removed the bpf_map_charge_init() call the check had been
    moved into by c85d69135a91

v3 -> v4:
  - simplify the bound to a single `max_entries >= U32_MAX /
    value_size` comparison, which also rejects max_entries == U32_MAX
  - check the bpf_map_create() return value directly instead of errno
    in the selftest

Yuan Chen (2):
  bpf: Fix queue/stack map u32 index overflow
  selftests/bpf: Add regression test for queue/stack map size limit

 kernel/bpf/queue_stack_maps.c                      |  9 ++++++
 .../selftests/bpf/prog_tests/queue_stack_map.c     | 37 ++++++++++++++++++++++
 2 files changed, 46 insertions(+)