bpf: devmap fix arithmetic overflow in bitmap_size calculation
authorJohn Fastabend <[email protected]>
Thu, 19 Oct 2017 16:03:52 +0000 (09:03 -0700)
committerDavid S. Miller <[email protected]>
Sat, 21 Oct 2017 23:54:09 +0000 (00:54 +0100)
commit8695a5395661fbb4a4f26c97f801f3800ae4754e
treed7f30a46a501e695325675205354a69c29bad81e
parent43ebf97fa40fc49242110d2bd50334fc6e95c802
bpf: devmap fix arithmetic overflow in bitmap_size calculation

An integer overflow is possible in dev_map_bitmap_size() when
calculating the BITS_TO_LONG logic which becomes, after macro
replacement,

(((n) + (d) - 1)/ (d))

where 'n' is a __u32 and 'd' is (8 * sizeof(long)). To avoid
overflow cast to u64 before arithmetic.

Reported-by: Richard Weinberger <[email protected]>
Acked-by: Daniel Borkmann <[email protected]>
Signed-off-by: John Fastabend <[email protected]>
Acked-by: Alexei Starovoitov <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
kernel/bpf/devmap.c