diff options
| author | Andrii Nakryiko <andrii@kernel.org> | 2024-04-30 13:19:51 -0700 |
|---|---|---|
| committer | Martin KaFai Lau <martin.lau@kernel.org> | 2024-05-02 16:41:02 -0700 |
| commit | 00f0e08f23fc007f4a5a71cd7e37fcdb15af0c1b (patch) | |
| tree | 9bf2f7de3fb366f9cda9f3566132e53885be313c | |
| parent | 29f38ca3e5ca5cacc33291f22c4848c6907b9d2b (diff) | |
| download | bpf-next-00f0e08f23fc007f4a5a71cd7e37fcdb15af0c1b.tar.gz | |
libbpf: fix potential overflow in ring__consume_n()
ringbuf_process_ring() return int64_t, while ring__consume_n() assigns
it to int. It's highly unlikely, but possible for ringbuf_process_ring()
to return value larger than INT_MAX, so use int64_t. ring__consume_n()
does check INT_MAX before returning int result to the user.
Fixes: 4d22ea94ea33 ("libbpf: Add ring__consume_n / ring_buffer__consume_n")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20240430201952.888293-1-andrii@kernel.org
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
| -rw-r--r-- | tools/lib/bpf/ringbuf.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/tools/lib/bpf/ringbuf.c b/tools/lib/bpf/ringbuf.c index 99e44cf0232120..37c5a2d86a782e 100644 --- a/tools/lib/bpf/ringbuf.c +++ b/tools/lib/bpf/ringbuf.c @@ -405,7 +405,7 @@ int ring__map_fd(const struct ring *r) int ring__consume_n(struct ring *r, size_t n) { - int res; + int64_t res; res = ringbuf_process_ring(r, n); if (res < 0) |