[bpf,v2,0/2] Fix hashmap overflow checks for 32-bit arches

Message

Toke Høiland-Jørgensen Feb. 29, 2024, 11:22 a.m. UTC

Syzbot managed to trigger a crash by creating a DEVMAP_HASH map with a
large number of buckets because the overflow check relies on
well-defined behaviour that is only correct on 64-bit arches.

Fix the overflow checks to happen before values are rounded up.

v2:
- Fix off-by-one error in overflow check
- Apply the same fix to hashtab, where the devmap_hash code was copied
  from (John)

Toke Høiland-Jørgensen (2):
  bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
  bpf: Fix hashtab overflow check on 32-bit arches

 kernel/bpf/devmap.c  |  8 +++-----
 kernel/bpf/hashtab.c | 10 +++++-----
 2 files changed, 8 insertions(+), 10 deletions(-)