diff options
author | David S. Miller <davem@davemloft.net> | 2021-08-07 10:26:54 +0200 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2021-08-07 10:26:54 +0200 |
commit | 84103209bab24440a156c476c2af890cec1f87d5 (patch) | |
tree | 7d1f1f5cd346316f3e582c1c90b90ef8a64027b4 /kernel | |
parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (diff) | |
parent | bpf: Fix integer overflow involving bucket_size (diff) | |
download | linux-84103209bab24440a156c476c2af890cec1f87d5.tar.xz linux-84103209bab24440a156c476c2af890cec1f87d5.zip |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Daniel Borkmann says:
====================
pull-request: bpf 2021-08-07
The following pull-request contains BPF updates for your *net* tree.
We've added 4 non-merge commits during the last 9 day(s) which contain
a total of 4 files changed, 8 insertions(+), 7 deletions(-).
The main changes are:
1) Fix integer overflow in htab's lookup + delete batch op, from Tatsuhiko Yasumatsu.
2) Fix invalid fd 0 close in libbpf if BTF parsing failed, from Daniel Xu.
3) Fix libbpf feature probe for BPF_PROG_TYPE_CGROUP_SOCKOPT, from Robin Gögge.
4) Fix minor libbpf doc warning regarding code-block language, from Randy Dunlap.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel')
-rw-r--r-- | kernel/bpf/hashtab.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index 72c58cc516a3..9c011f3a2687 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -1565,8 +1565,8 @@ alloc: /* We cannot do copy_from_user or copy_to_user inside * the rcu_read_lock. Allocate enough space here. */ - keys = kvmalloc(key_size * bucket_size, GFP_USER | __GFP_NOWARN); - values = kvmalloc(value_size * bucket_size, GFP_USER | __GFP_NOWARN); + keys = kvmalloc_array(key_size, bucket_size, GFP_USER | __GFP_NOWARN); + values = kvmalloc_array(value_size, bucket_size, GFP_USER | __GFP_NOWARN); if (!keys || !values) { ret = -ENOMEM; goto after_loop; |