Messages in this thread | | | From | Lorenz Bauer <> | Date | Tue, 26 Jan 2021 09:36:57 +0000 | Subject | Re: [PATCH] bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc |
| |
On Tue, 26 Jan 2021 at 08:26, Bui Quang Minh <minhquangbui99@gmail.com> wrote: > > In 32-bit architecture, the result of sizeof() is a 32-bit integer so > the expression becomes the multiplication between 2 32-bit integer which > can potentially leads to integer overflow. As a result, > bpf_map_area_alloc() allocates less memory than needed. > > Fix this by casting 1 operand to u64.
Some quick thoughts: * Should this have a Fixes tag? * Seems like there are quite a few similar calls scattered around (cpumap, etc.). Did you audit these as well? * I'd prefer a calloc style version of bpf_map_area_alloc although that might conflict with Fixes tag.
Lorenz
-- Lorenz Bauer | Systems Engineer 6th Floor, County Hall/The Riverside Building, SE1 7PB, UK
www.cloudflare.com
| |