Re: [PATCH bpf v2] bpf: Add nelems overflow check in btf_find_field_one()

[Alexei Starovoitov]

On Sat, May 23, 2026 at 9:47 AM Himanshu Anand
<anand.himanshu17@xxxxxxxxx> wrote:
>
> btf_find_field_one() multiplies a u32 nelems accumulator by each
> nested array level's element count without checking for overflow.
> The sibling function __btf_resolve_size() already guards against
> the same overflow pattern (btf.c line 2110).
>
> Currently the BTF array verifier (btf_array_resolve) rejects BTF
> blobs whose total array size would overflow u32, so this code path
> is not reachable with crafted BTF input on kernels that include
> that check.  Add check_mul_overflow() anyway to keep
> btf_find_field_one() self-consistent with __btf_resolve_size()
> and to guard against future changes in the validation ordering.
>
> Fixes: 994796c0256c ("bpf: create repeated fields for arrays.")
> Signed-off-by: Himanshu Anand <anand.himanshu17@xxxxxxxxx>
> ---
>  kernel/bpf/btf.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index a62d78581207..b767a9fcf095 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -3765,7 +3765,8 @@ static int btf_find_field_one(const struct btf *btf,
>          */
>         for (i = 0; i < MAX_RESOLVE_DEPTH && btf_type_is_array(var_type); i++) {
>                 array = btf_array(var_type);
> -               nelems *= array->nelems;
> +               if (check_mul_overflow(nelems, array->nelems, &nelems))
> +                       return -E2BIG;

It's unnecessary.
see __btf_resolve_size() and btf_array_resolve().

pw-bot: cr