BugLink: http://bugs.launchpad.net/bugs/1745266

commit bbeb6e43 upstream.

syzkaller tried to alloc a map with 0xfffffffd entries out of a userns,
and thus unprivileged. With the recently added logic in b2157399
("bpf: prevent out-of-bounds speculation") we round this up to the next
power of two value for max_entries for unprivileged such that we can
apply proper masking into potentially zeroed out map slots.

However, this will generate an index_mask of 0xffffffff, and therefore
a + 1 will let this overflow into new max_entries of 0. This will pass
allocation, etc, and later on map access we still enforce on the original
attr->max_entries value which was 0xfffffffd, therefore triggering GPF
all over the place. Thus bail out on overflow in such case.

Moreover, on 32 bit archs roundup_pow_of_two() can also not be used,
since fls_long(max_entries - 1) can result in 32 and 1UL << 32 in 32 bit
space is undefined. Therefore, do this by hand in a 64 bit variable.

This fixes all the issues triggered by syzkaller's reproducers.

Fixes: b2157399

 ("bpf: prevent out-of-bounds speculation")
Reported-by:  <syzbot+b0efb8e572d01bce1ae0@syzkaller.appspotmail.com>
Reported-by:  <syzbot+6c15e9744f75f2364773@syzkaller.appspotmail.com>
Reported-by:  <syzbot+d2f5524fb46fd3b312ee@syzkaller.appspotmail.com>
Reported-by:  <syzbot+61d23c95395cc90dbc2b@syzkaller.appspotmail.com>
Reported-by:  <syzbot+0d363c942452cca68c01@syzkaller.appspotmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>