]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
libbpf: Guard add_data() against size overflow
authorDaniel Borkmann <daniel@iogearbox.net>
Tue, 2 Jun 2026 13:30:50 +0000 (15:30 +0200)
committerAlexei Starovoitov <ast@kernel.org>
Tue, 2 Jun 2026 16:46:52 +0000 (09:46 -0700)
commit7fef1796ec4d8c4cce70c374efafdbbc8d6d6cbc
tree11c73a59914a000771826ee6fa54528263a5a089
parent3c56ee343f9412d81918635c3e25e22a5dd6d87e
libbpf: Guard add_data() against size overflow

add_data() computes size8 = roundup(size, 8) and then hands size8 to
realloc_data_buf() before doing memcpy(gen->data_cur, data, size) with
the original size. A wrapped size8 passes through the realloc_data_buf()
INT32_MAX check. Harden this against overflow, though not realistic to
happen in practice.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260602133052.423725-3-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
tools/lib/bpf/gen_loader.c