Re: [PATCH v3] bpf: Fix u32 overflow issue in map batch operations

[Masoud Aghasi <maghasi@disroot.org>]

On 04/09/2026 05:45, Alexei Starovoitov wrote:
> On Thu, Sep 3, 2026 at 1:28 AM Masoud Aghasi <maghasi@disroot.org> wrote:
>>
>> Several map batch operation implementations such as
>> generic_map_lookup_batch() use calculations in the form of
>> "values + cp * map->value_size" to compute the desired userspace memory
>> address for reading or writing. This can overflow the u32 type
>> (the result of "cp * map->value_size") when the map size exceeds 4GB.
>>
>> generic_map_lookup_batch() may corrupt values for some keys in
>> userspace memory, and in some cases it mismatches values for some keys
>> while still reporting success.
> 
> without selftest I have to assume that this is AI hallucination.
> 
> pw-bot: cr

Thanks for the review.

I didn't found this bug using AI. I posted the sample program that
reproduces the issue in v1. The reason I didn't include a selftest is
that reproducing the issue requires 8GB+ memory allocation, which I
don't think is appropriate for the regular BPF selftest suite.

Personally, I'm not sure an opt-in test would provide much value as a
regression test, since it would not be exercised during the regular
selftest runs. However, I'm happy to add an opt-in EXTENDED selftest in
v4 (using TEST_GEN_PROGS_EXTENDED in Makefile), if you think retaining
an explicit reproducer in the kernel selftests is worthwhile.