diff options
| author | Stanislav Fomichev <sdf@google.com> | 2022-02-04 15:58:49 -0800 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2022-02-07 18:26:13 -0800 |
| commit | 5d1e9f437df5ef21e7567f1970a00fda3b5d1126 (patch) | |
| tree | 22267ad2bc9cda02f71f8107ff3fbd530314abe3 /net/bpf | |
| parent | 9d63b59d1e9d2daf662c5951e79bf89c99f3a8b7 (diff) | |
| download | linux-5d1e9f437df5ef21e7567f1970a00fda3b5d1126.tar.gz | |
bpf: test_run: Fix overflow in bpf_test_finish frags parsing
This place also uses signed min_t and passes this singed int to
copy_to_user (which accepts unsigned argument). I don't think
there is an issue, but let's be consistent.
Fixes: 7855e0db150ad ("bpf: test_run: add xdp_shared_info pointer in bpf_test_finish signature")
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20220204235849.14658-2-sdf@google.com
Diffstat (limited to 'net/bpf')
| -rw-r--r-- | net/bpf/test_run.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index 5819a7a5e3c6..cb150f756f3d 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -154,7 +154,8 @@ static int bpf_test_finish(const union bpf_attr *kattr, goto out; if (sinfo) { - int i, offset = len, data_len; + int i, offset = len; + u32 data_len; for (i = 0; i < sinfo->nr_frags; i++) { skb_frag_t *frag = &sinfo->frags[i]; @@ -164,7 +165,7 @@ static int bpf_test_finish(const union bpf_attr *kattr, break; } - data_len = min_t(int, copy_size - offset, + data_len = min_t(u32, copy_size - offset, skb_frag_size(frag)); if (copy_to_user(data_out + offset, |