summaryrefslogtreecommitdiff
path: root/include/linux/timerqueue_types.h
diff options
context:
space:
mode:
authorDaniel Borkmann <daniel@iogearbox.net>2026-06-02 15:30:50 +0200
committerAlexei Starovoitov <ast@kernel.org>2026-06-02 09:46:52 -0700
commit7fef1796ec4d8c4cce70c374efafdbbc8d6d6cbc (patch)
tree11c73a59914a000771826ee6fa54528263a5a089 /include/linux/timerqueue_types.h
parent3c56ee343f9412d81918635c3e25e22a5dd6d87e (diff)
libbpf: Guard add_data() against size overflow
add_data() computes size8 = roundup(size, 8) and then hands size8 to realloc_data_buf() before doing memcpy(gen->data_cur, data, size) with the original size. A wrapped size8 passes through the realloc_data_buf() INT32_MAX check. Harden this against overflow, though not realistic to happen in practice. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20260602133052.423725-3-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'include/linux/timerqueue_types.h')
0 files changed, 0 insertions, 0 deletions