From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Dumazet Subject: [PATCH bpf-next] bpf: fix sock_map_alloc() error path Date: Tue, 13 Feb 2018 15:33:52 -0800 Message-ID: <1518564832.3715.187.camel@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit Cc: netdev , Daniel Borkmann To: John Fastabend , Alexei Starovoitov Return-path: Received: from mail-pl0-f65.google.com ([209.85.160.65]:37269 "EHLO mail-pl0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966160AbeBMXdy (ORCPT ); Tue, 13 Feb 2018 18:33:54 -0500 Received: by mail-pl0-f65.google.com with SMTP id ay8so7452016plb.4 for ; Tue, 13 Feb 2018 15:33:54 -0800 (PST) Sender: netdev-owner@vger.kernel.org List-ID: From: Eric Dumazet In case user program provides silly parameters, we want a map_alloc() handler to return an error, not a NULL pointer, otherwise we crash later in find_and_alloc_map() Fixes: 174a79ff9515 ("bpf: sockmap with sk redirect support") Signed-off-by: Eric Dumazet Reported-by: syzbot ---  kernel/bpf/sockmap.c |    3 ++-  1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c index 48c33417d13c0ad40154f25aeade0c9b4cafd96a..a927e89dad6e9591066c3a87afc497a196ebd887 100644 --- a/kernel/bpf/sockmap.c +++ b/kernel/bpf/sockmap.c @@ -521,8 +521,8 @@ static struct smap_psock *smap_init_psock(struct sock *sock, static struct bpf_map *sock_map_alloc(union bpf_attr *attr) { struct bpf_stab *stab; - int err = -EINVAL; u64 cost; + int err; if (!capable(CAP_NET_ADMIN)) return ERR_PTR(-EPERM); @@ -547,6 +547,7 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr) /* make sure page count doesn't overflow */ cost = (u64) stab->map.max_entries * sizeof(struct sock *); + err = -EINVAL; if (cost >= U32_MAX - PAGE_SIZE) goto free_stab;