[PATCH bpf-next 0/2] bpf: Fix the array map gen_lookup index bounds check

[Yuan Chen <chenyuan@kylinos.cn>]

The inlined bpf_map_lookup_elem() of the array map flavors bounds the
index with a 64-bit JGE against map->max_entries.  The index is a
zero-extended u32, but the immediate of a 64-bit JGE is sign-extended,
so for max_entries >= 0x80000000 the compare is never true.

With bypass_spec_v1 the inlined code then addresses the array out of
bounds; without it the index_mask AND keeps the access in bounds, but an
out-of-range key returns a masked element instead of NULL.

Patch 1 switches the three compares to BPF_JMP32_IMM().  Patch 2 adds a
selftest that checks the emitted compare in the translated program.

Yuan Chen (2):
  bpf: Use a 32-bit compare in the array map gen_lookups
  selftests/bpf: Test the emitted bounds check of the array gen_lookup

 kernel/bpf/arraymap.c                         |  12 +-
 .../bpf/prog_tests/array_gen_lookup_jmp32.c   | 204 ++++++++++++++++++
 2 files changed, 210 insertions(+), 6 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/array_gen_lookup_jmp32.c

-- 
2.54.0