btf_find_field_one() multiplies a u32 nelems accumulator by each nested array level's element count without checking for overflow. The sibling function __btf_resolve_size() already guards against the same overflow pattern (btf.c line 2110). Currently the BTF array verifier (btf_array_resolve) rejects BTF blobs whose total array size would overflow u32, so this code path is not reachable with crafted BTF input on kernels that include that check. Add check_mul_overflow() anyway to keep btf_find_field_one() self-consistent with __btf_resolve_size() and to guard against future changes in the validation ordering. Fixes: 994796c0256c ("bpf: create repeated fields for arrays.") Signed-off-by: Himanshu Anand --- kernel/bpf/btf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index a62d78581207..b767a9fcf095 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -3765,7 +3765,8 @@ static int btf_find_field_one(const struct btf *btf, */ for (i = 0; i < MAX_RESOLVE_DEPTH && btf_type_is_array(var_type); i++) { array = btf_array(var_type); - nelems *= array->nelems; + if (check_mul_overflow(nelems, array->nelems, &nelems)) + return -E2BIG; var_type = btf_type_by_id(btf, array->type); } if (i == MAX_RESOLVE_DEPTH) -- 2.34.1