diff options
| author | Eric Dumazet <edumazet@google.com> | 2018-02-14 02:33:52 +0300 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2018-02-14 06:19:15 +0300 |
| commit | 952fad8e323975c4e826b659087d2648777594a6 (patch) | |
| tree | b975a4eda33630af0c7e11d8b76d1184eb6ba5d9 | |
| parent | 9a3efb6b661f71d5675369ace9257833f0e78ef3 (diff) | |
| download | linux-952fad8e323975c4e826b659087d2648777594a6.tar.xz | |
bpf: fix sock_map_alloc() error path
In case user program provides silly parameters, we want
a map_alloc() handler to return an error, not a NULL pointer,
otherwise we crash later in find_and_alloc_map()
Fixes: 1aa12bdf1bfb ("bpf: sockmap, add sock close() hook to remove socks")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
| -rw-r--r-- | kernel/bpf/sockmap.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c index 48c33417d13c..a927e89dad6e 100644 --- a/kernel/bpf/sockmap.c +++ b/kernel/bpf/sockmap.c @@ -521,8 +521,8 @@ static struct smap_psock *smap_init_psock(struct sock *sock, static struct bpf_map *sock_map_alloc(union bpf_attr *attr) { struct bpf_stab *stab; - int err = -EINVAL; u64 cost; + int err; if (!capable(CAP_NET_ADMIN)) return ERR_PTR(-EPERM); @@ -547,6 +547,7 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr) /* make sure page count doesn't overflow */ cost = (u64) stab->map.max_entries * sizeof(struct sock *); + err = -EINVAL; if (cost >= U32_MAX - PAGE_SIZE) goto free_stab; |