Re: [PATCH bpf v5 0/2] bpf: Fix queue/stack map u32 index overflow

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Andrii Nakryiko <andrii@kernel.org>:

On Mon, 31 Aug 2026 14:32:24 +0800 you wrote:
> From: Yuan Chen <chenyuan@kylinos.cn>
> 
> This series fixes an integer overflow in BPF queue/stack maps.  The u32
> head/tail index is multiplied by value_size to address elements[], but
> the storage itself is allocated with 64-bit arithmetic.  When
> max_entries * value_size reaches or exceeds U32_MAX, the index
> multiplication wraps and push/peek/pop operate on the wrong element,
> corrupting map data and leaking stale values to user space.
> max_entries == U32_MAX would also wrap the u32 capacity counter
> qs->size (max_entries + 1) to 0 and permanently break the map.
> 
> [...]

Here is the summary with links:
  - [bpf,v5,1/2] bpf: Fix queue/stack map u32 index overflow
    https://git.kernel.org/bpf/bpf-next/c/802a30c5db72
  - [bpf,v5,2/2] selftests/bpf: Add regression test for queue/stack map size limit
    https://git.kernel.org/bpf/bpf-next/c/33576bfee5b7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html