patch 'bpf/validate: prevent overflow when building graph' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/04/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/9166b8178252bd101529fee204d6e23774977924

Thanks.

Kevin

---
>From 9166b8178252bd101529fee204d6e23774977924 Mon Sep 17 00:00:00 2001
From: Marat Khalili <marat.khalili at huawei.com>
Date: Wed, 24 Jun 2026 13:17:56 +0100
Subject: [PATCH] bpf/validate: prevent overflow when building graph

[ upstream commit 1ad243a134be6109b0b8f969a0154186997ff935 ]

Function `evst_pool_init` for malicious or corrupt BPF program with
number of conditional jumps exceeding a third of UINT32_MAX could cause
arithmetic and buffer overflows when working with the program graph.

Fix the issue by limiting maximum number of conditional jumps supported
by UINT32_MAX / 4, or more than 1 billion.

Fixes: 8021917293d0 ("bpf: add extra validation for input BPF program")

Reported-by: Claudia Cauli <claudiacauli at gmail.com>
Signed-off-by: Marat Khalili <marat.khalili at huawei.com>
Acked-by: Konstantin Ananyev <konstantin.ananyev at huawei.com>
---
 lib/bpf/bpf_validate.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/bpf/bpf_validate.c b/lib/bpf/bpf_validate.c
index 4876ab0ed3..ac7d7cd75e 100644
--- a/lib/bpf/bpf_validate.c
+++ b/lib/bpf/bpf_validate.c
@@ -2158,4 +2158,8 @@ evst_pool_init(struct bpf_verifier *bvf)
 	uint32_t k, n;
 
+	if (bvf->nb_jcc_nodes > UINT32_MAX / 4)
+		/* Calculations that follow may overflow. */
+		return -E2BIG;
+
 	/*
 	 * We need nb_jcc_nodes + 1 for save_cur/restore_cur
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-30 10:16:02.459209112 +0100
+++ 0033-bpf-validate-prevent-overflow-when-building-graph.patch	2026-07-30 10:16:01.469106718 +0100
@@ -1 +1 @@
-From 1ad243a134be6109b0b8f969a0154186997ff935 Mon Sep 17 00:00:00 2001
+From 9166b8178252bd101529fee204d6e23774977924 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 1ad243a134be6109b0b8f969a0154186997ff935 ]
+
@@ -14 +15,0 @@
-Cc: stable at dpdk.org
@@ -24 +25 @@
-index 03c590c753..f9960088a2 100644
+index 4876ab0ed3..ac7d7cd75e 100644
@@ -27 +28 @@
-@@ -2663,4 +2663,8 @@ evst_pool_init(struct bpf_verifier *bvf)
+@@ -2158,4 +2158,8 @@ evst_pool_init(struct bpf_verifier *bvf)