Re: [PATCH] bpf: Fix u32 overflow issue in map batch operations

[Masoud Aghasi <maghasi@disroot.org>]

On 24/08/2026 12:42, sashiko-bot@kernel.org wrote:
> 
> [Severity: High]
> This is a pre-existing issue, but does key_size * bucket_cnt or
> value_size * bucket_cnt also need a size_t cast here?
> 
> If value_size * bucket_cnt exceeds 4GB, the 32-bit integer overflow would
> truncate the length argument to copy_to_user() in
> __htab_map_lookup_and_delete_batch(), causing it to copy less data than
> expected. This could result in silent data loss since the elements are
> permanently deleted from the kernel map, while the syscall falsely returns
> success.
> 
>>  	    value_size * bucket_cnt))) {
>>  		ret = -EFAULT;
>>  		goto after_loop;
> 

Yes, I was able to produce "bucket_cnt > 1024" using a map with
BPF_F_ZERO_SEED flag set, 64bit key_size and generating an special
sequence of keys using the below code:

```c
int counter = 0;
__u64 keys[1025];
for (unsigned long i = 0x10000; i <= 0xffffffffffffffff; i++) {
  if ((jhash2((__u32 *)&i, 2, 0) & (0x10000 - 1)) == 0) {
    keys[counter] = i;
    counter++;
    if(counter > 1024)
      break;
  }
}
```

So the overflow is possible and I will include the fix in the patch v2.