bpf: devmap fix arithmetic overflow in bitmap_size calculation
authorJohn Fastabend <john.r.fastabend@gmail.com>
Thu, 19 Oct 2017 16:03:52 +0000 (09:03 -0700)
committerDavid S. Miller <davem@davemloft.net>
Sat, 21 Oct 2017 23:54:09 +0000 (00:54 +0100)
commit8695a5395661fbb4a4f26c97f801f3800ae4754e
treed7f30a46a501e695325675205354a69c29bad81e
parent43ebf97fa40fc49242110d2bd50334fc6e95c802
bpf: devmap fix arithmetic overflow in bitmap_size calculation

An integer overflow is possible in dev_map_bitmap_size() when
calculating the BITS_TO_LONG logic which becomes, after macro
replacement,

(((n) + (d) - 1)/ (d))

where 'n' is a __u32 and 'd' is (8 * sizeof(long)). To avoid
overflow cast to u64 before arithmetic.

Reported-by: Richard Weinberger <richard@nod.at>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
kernel/bpf/devmap.c