Re: [PATCH] bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc
From: Lorenz Bauer <hidden>
Date: 2021-01-26 11:28:01
Also in:
bpf, lkml
On Tue, 26 Jan 2021 at 08:26, Bui Quang Minh [off-list ref] wrote:
In 32-bit architecture, the result of sizeof() is a 32-bit integer so the expression becomes the multiplication between 2 32-bit integer which can potentially leads to integer overflow. As a result, bpf_map_area_alloc() allocates less memory than needed. Fix this by casting 1 operand to u64.
Some quick thoughts: * Should this have a Fixes tag? * Seems like there are quite a few similar calls scattered around (cpumap, etc.). Did you audit these as well? * I'd prefer a calloc style version of bpf_map_area_alloc although that might conflict with Fixes tag. Lorenz -- Lorenz Bauer | Systems Engineer 6th Floor, County Hall/The Riverside Building, SE1 7PB, UK www.cloudflare.com