Merge branch 'bpf-fix-queue-stack-map-u32-index-overflow'

Yuan Chen says:

====================
bpf: Fix queue/stack map u32 index overflow

From: Yuan Chen <chenyuan@kylinos.cn>

This series fixes an integer overflow in BPF queue/stack maps.  The u32
head/tail index is multiplied by value_size to address elements[], but
the storage itself is allocated with 64-bit arithmetic.  When
max_entries * value_size reaches or exceeds U32_MAX, the index
multiplication wraps and push/peek/pop operate on the wrong element,
corrupting map data and leaking stale values to user space.
max_entries == U32_MAX would also wrap the u32 capacity counter
qs->size (max_entries + 1) to 0 and permanently break the map.

Patch 1 restores the size bound in queue_stack_map_alloc_check() that
was lost when the check inside bpf_map_charge_init() was removed.  A
single division-based comparison covers both the index multiplication
overflow and the capacity counter wrap.

Patch 2 adds a regression test for both rejection cases.

v2 -> v3:
  - also reject max_entries == U32_MAX, which would wrap the u32
    capacity counter qs->size (max_entries + 1) to 0
  - fix the Fixes tag: the guard was actually dropped by a37fb7ef24a4,
    which removed the bpf_map_charge_init() call the check had been
    moved into by c85d69135a91

v3 -> v4:
  - simplify the bound to a single `max_entries >= U32_MAX /
    value_size` comparison, which also rejects max_entries == U32_MAX
  - check the bpf_map_create() return value directly instead of errno
    in the selftest

v4 -> v5:
  - drop the explanatory comment in queue_stack_map_alloc_check()
  - selftest: drop the unused bpf_map_create_opts, inline the 1MB value
    size, close the fd if bpf_map_create() unexpectedly returns a valid
    fd, and drop the verbose comments
====================

Link: https://patch.msgid.link/20260831063226.621309-1-chenyuan_fl@163.com
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

0 files changed, 0 insertions, 0 deletions