Skip to contentSkip to conversation

bpf: null dereference allocating large arrays

PATCH In review Dan Carpenter 2 participants 2 messages Nov 22, 2014

Subsystems (4)
Networking Network drivers Kernel janitors BPF
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 bpf: null dereference allocating large arrays

There is a typo here, "array" is null so we can't dereference it and also the size calculation should match the kzalloc() on the lines before.

Signed-off-by Dan Carpenter <[email protected]>
kernel/bpf/arraymap.c +1 -1
index 58b80c1..662a412 100644
@@ -38,7 +38,7 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr)
 	array = kzalloc(sizeof(*array) + attr->max_entries * elem_size,
 			GFP_USER | __GFP_NOWARN);
 	if (!array) {
-		array = vzalloc(array->map.max_entries * array->elem_size);
+		array = vzalloc(sizeof(*array) + attr->max_entries * elem_size);
 		if (!array)
 			return ERR_PTR(-ENOMEM);
 	}
#1 lore raw
Quoted 3 lines · Dan Carpenter

There is a typo here, "array" is null so we can't dereference it and also the size calculation should match the kzalloc() on the lines before.

Not sure what tree you're looking at...
it was more than typo, but it was fixed 4 days ago.
See commit daaf427c6ab39 ("bpf: fix arraymap NULL deref and missing overflow and zero size checks")