Commit 5d1e9f43 authored by Stanislav Fomichev's avatar Stanislav Fomichev Committed by Alexei Starovoitov
Browse files

bpf: test_run: Fix overflow in bpf_test_finish frags parsing 



This place also uses signed min_t and passes this singed int to
copy_to_user (which accepts unsigned argument). I don't think
there is an issue, but let's be consistent.

Fixes: 7855e0db ("bpf: test_run: add xdp_shared_info pointer in bpf_test_finish signature")
Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarYonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20220204235849.14658-2-sdf@google.com
parent 9d63b59d

net/bpf/test_run.c

+3 −2
Original line number Diff line number Diff line
@@ -154,7 +154,8 @@ static int bpf_test_finish(const union bpf_attr *kattr, 
			goto out;



		if (sinfo) {

			int i, offset = len, data_len;

			int i, offset = len;

			u32 data_len;



			for (i = 0; i < sinfo->nr_frags; i++) {

				skb_frag_t *frag = &sinfo->frags[i];
@@ -164,7 +165,7 @@ static int bpf_test_finish(const union bpf_attr *kattr, 
					break;

				}



				data_len = min_t(int, copy_size - offset,

				data_len = min_t(u32, copy_size - offset,

						 skb_frag_size(frag));



				if (copy_to_user(data_out + offset,