From: Yuan Chen The queue/stack map addresses elements[] with the product of a u32 head/tail index and value_size, but the storage itself is allocated in 64-bit arithmetic. When max_entries * value_size exceeds U32_MAX, the product wraps and push/peek/pop operate on the wrong element, corrupting map data and leaking stale values to user space. The original bound check was removed by c85d69135a91 ("bpf: move memory size checks to bpf_map_charge_init()"), which migrated only the bytes-to-pages conversion and dropped the overflow guard, so oversized queue/stack maps can be created again. Restore the bound in queue_stack_map_alloc_check(): reject maps whose element storage would exceed U32_MAX bytes, keeping the u32 index multiplication overflow-free. Fixes: c85d69135a91 ("bpf: move memory size checks to bpf_map_charge_init()") Signed-off-by: Yuan Chen --- kernel/bpf/queue_stack_maps.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/bpf/queue_stack_maps.c b/kernel/bpf/queue_stack_maps.c index c1c9dee4dcdd..f9ff701ab27b 100644 --- a/kernel/bpf/queue_stack_maps.c +++ b/kernel/bpf/queue_stack_maps.c @@ -59,6 +59,13 @@ static int queue_stack_map_alloc_check(union bpf_attr *attr) */ return -E2BIG; + /* + * The u32 head/tail index is multiplied by value_size to address + * elements[]. Bound the map size so the product cannot overflow. + */ + if ((u64)attr->max_entries * attr->value_size > U32_MAX) + return -E2BIG; + return 0; } -- 2.54.0