bpf: fix potential 32-bit overflow when accessing ARRAY map element
authorAndrii Nakryiko <andrii@kernel.org>
Fri, 15 Jul 2022 05:31:43 +0000 (22:31 -0700)
committerAlexei Starovoitov <ast@kernel.org>
Tue, 19 Jul 2022 16:45:34 +0000 (09:45 -0700)
commit87ac0d600943994444e24382a87aa19acc4cd3d4
treee4af751c0f261ec49b5d6d6221ef26cf7ff99348
parente5e23424e51edbd8b3fabae382aeec0bb8926cf1
bpf: fix potential 32-bit overflow when accessing ARRAY map element

If BPF array map is bigger than 4GB, element pointer calculation can
overflow because both index and elem_size are u32. Fix this everywhere
by forcing 64-bit multiplication. Extract this formula into separate
small helper and use it consistently in various places.

Speculative-preventing formula utilizing index_mask trick is left as is,
but explicit u64 casts are added in both places.

Fixes: c85d69135a91 ("bpf: move memory size checks to bpf_map_charge_init()")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20220715053146.1291891-2-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/arraymap.c