summaryrefslogtreecommitdiff
path: root/net/bpf
diff options
context:
space:
mode:
authorStanislav Fomichev <sdf@google.com>2022-02-05 02:58:49 +0300
committerAlexei Starovoitov <ast@kernel.org>2022-02-08 05:26:13 +0300
commit5d1e9f437df5ef21e7567f1970a00fda3b5d1126 (patch)
tree22267ad2bc9cda02f71f8107ff3fbd530314abe3 /net/bpf
parent9d63b59d1e9d2daf662c5951e79bf89c99f3a8b7 (diff)
downloadlinux-5d1e9f437df5ef21e7567f1970a00fda3b5d1126.tar.xz
bpf: test_run: Fix overflow in bpf_test_finish frags parsing
This place also uses signed min_t and passes this singed int to copy_to_user (which accepts unsigned argument). I don't think there is an issue, but let's be consistent. Fixes: 7855e0db150ad ("bpf: test_run: add xdp_shared_info pointer in bpf_test_finish signature") Signed-off-by: Stanislav Fomichev <sdf@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/20220204235849.14658-2-sdf@google.com
Diffstat (limited to 'net/bpf')
-rw-r--r--net/bpf/test_run.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 5819a7a5e3c6..cb150f756f3d 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -154,7 +154,8 @@ static int bpf_test_finish(const union bpf_attr *kattr,
goto out;
if (sinfo) {
- int i, offset = len, data_len;
+ int i, offset = len;
+ u32 data_len;
for (i = 0; i < sinfo->nr_frags; i++) {
skb_frag_t *frag = &sinfo->frags[i];
@@ -164,7 +165,7 @@ static int bpf_test_finish(const union bpf_attr *kattr,
break;
}
- data_len = min_t(int, copy_size - offset,
+ data_len = min_t(u32, copy_size - offset,
skb_frag_size(frag));
if (copy_to_user(data_out + offset,