diff options
| author | Daniel Borkmann <daniel@iogearbox.net> | 2018-05-04 16:27:53 +0200 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2018-05-04 23:55:54 +0200 |
| commit | e94fa1d93117e7f1eb783dc9cae6c70650944449 (patch) | |
| tree | c49a617e7a4e12030e511cb5f296439e58155d37 /kernel/bpf/xskmap.c | |
| parent | Merge branch 'bpf-event-output-offload' (diff) | |
| download | linux-e94fa1d93117e7f1eb783dc9cae6c70650944449.tar.xz linux-e94fa1d93117e7f1eb783dc9cae6c70650944449.zip | |
bpf, xskmap: fix crash in xsk_map_alloc error path handling
If bpf_map_precharge_memlock() did not fail, then we set err to zero.
However, any subsequent failure from either alloc_percpu() or the
bpf_map_area_alloc() will return ERR_PTR(0) which in find_and_alloc_map()
will cause NULL pointer deref.
In devmap we have the convention that we return -EINVAL on page count
overflow, so keep the same logic here and just set err to -ENOMEM
after successful bpf_map_precharge_memlock().
Fixes: fbfc504a24f5 ("bpf: introduce new bpf AF_XDP map type BPF_MAP_TYPE_XSKMAP")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Björn Töpel <bjorn.topel@intel.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel/bpf/xskmap.c')
| -rw-r--r-- | kernel/bpf/xskmap.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/kernel/bpf/xskmap.c b/kernel/bpf/xskmap.c index 869dbb11b612..cb3a12137404 100644 --- a/kernel/bpf/xskmap.c +++ b/kernel/bpf/xskmap.c @@ -56,6 +56,8 @@ static struct bpf_map *xsk_map_alloc(union bpf_attr *attr) if (err) goto free_m; + err = -ENOMEM; + m->flush_list = alloc_percpu(struct list_head); if (!m->flush_list) goto free_m; |