summaryrefslogtreecommitdiff
path: root/net/core
diff options
context:
space:
mode:
authorBui Quang Minh <minhquangbui99@gmail.com>2021-06-13 21:34:39 +0700
committerAlexei Starovoitov <ast@kernel.org>2021-06-22 10:14:29 -0700
commit7dd5d437c258bbf4cc15b35229e5208b87b8b4e0 (patch)
tree15bd18fdc23176c4b1cc3bef90042a8a068dd22a /net/core
parent5dec6d96d12d33900ec315972c8e47a73bcc378d (diff)
bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc
In 32-bit architecture, the result of sizeof() is a 32-bit integer so the expression becomes the multiplication between 2 32-bit integer which can potentially leads to integer overflow. As a result, bpf_map_area_alloc() allocates less memory than needed. Fix this by casting 1 operand to u64. Fixes: 0d2c4f964050 ("bpf: Eliminate rlimit-based memory accounting for sockmap and sockhash maps") Fixes: 99c51064fb06 ("devmap: Use bpf_map_area_alloc() for allocating hash buckets") Fixes: 546ac1ffb70d ("bpf: add devmap, a map for storing net device references") Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20210613143440.71975-1-minhquangbui99@gmail.com
Diffstat (limited to 'net/core')
-rw-r--r--net/core/sock_map.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/core/sock_map.c b/net/core/sock_map.c
index 6f1b82b8ad49..60decd6420ca 100644
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -48,7 +48,7 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr)
bpf_map_init_from_attr(&stab->map, attr);
raw_spin_lock_init(&stab->lock);
- stab->sks = bpf_map_area_alloc(stab->map.max_entries *
+ stab->sks = bpf_map_area_alloc((u64) stab->map.max_entries *
sizeof(struct sock *),
stab->map.numa_node);
if (!stab->sks) {