]> git.baikalelectronics.ru Git - kernel.git/commit
bpf: fix potential 32-bit overflow when accessing ARRAY map element
authorAndrii Nakryiko <andrii@kernel.org>
Fri, 15 Jul 2022 05:31:43 +0000 (22:31 -0700)
committerAlexei Starovoitov <ast@kernel.org>
Tue, 19 Jul 2022 16:45:34 +0000 (09:45 -0700)
commitec808514930a224b558620b09a5242c177f12e48
treee4af751c0f261ec49b5d6d6221ef26cf7ff99348
parent9b5ca46c182a0bb10801e713bc1b1b95c54b63b4
bpf: fix potential 32-bit overflow when accessing ARRAY map element

If BPF array map is bigger than 4GB, element pointer calculation can
overflow because both index and elem_size are u32. Fix this everywhere
by forcing 64-bit multiplication. Extract this formula into separate
small helper and use it consistently in various places.

Speculative-preventing formula utilizing index_mask trick is left as is,
but explicit u64 casts are added in both places.

Fixes: e650ab9e53b9 ("bpf: move memory size checks to bpf_map_charge_init()")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20220715053146.1291891-2-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/arraymap.c