1 files changed, 20 insertions, 5 deletions

diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 3ea87fb19a94..63c86a7be2a1 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -45,8 +45,13 @@ enum extra_elem_state {
 struct htab_elem {
         union {
                 struct hlist_node hash_node;
-                struct bpf_htab *htab;
-                struct pcpu_freelist_node fnode;
+                struct {
+                        void *padding;
+                        union {
+                                struct bpf_htab *htab;
+                                struct pcpu_freelist_node fnode;
+                        };
+                };
         };
         union {
                 struct rcu_head rcu;
@@ -162,7 +167,8 @@ skip_percpu_elems:
                                  offsetof(struct htab_elem, lru_node),
                                  htab->elem_size, htab->map.max_entries);
         else
-                pcpu_freelist_populate(&htab->freelist, htab->elems,
+                pcpu_freelist_populate(&htab->freelist,
+                                       htab->elems + offsetof(struct htab_elem, fnode),
                                        htab->elem_size, htab->map.max_entries);
 
         return 0;
@@ -217,6 +223,11 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
         int err, i;
         u64 cost;
 
+        BUILD_BUG_ON(offsetof(struct htab_elem, htab) !=
+                     offsetof(struct htab_elem, hash_node.pprev));
+        BUILD_BUG_ON(offsetof(struct htab_elem, fnode.next) !=
+                     offsetof(struct htab_elem, hash_node.pprev));
+
         if (lru && !capable(CAP_SYS_ADMIN))
                 /* LRU implementation is much complicated than other
                  * maps.  Hence, limit to CAP_SYS_ADMIN for now.
@@ -582,9 +593,13 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
         int err = 0;
 
         if (prealloc) {
-                l_new = (struct htab_elem *)pcpu_freelist_pop(&htab->freelist);
-                if (!l_new)
+                struct pcpu_freelist_node *l;
+
+                l = pcpu_freelist_pop(&htab->freelist);
+                if (!l)
                         err = -E2BIG;
+                else
+                        l_new = container_of(l, struct htab_elem, fnode);
         } else {
                 if (atomic_inc_return(&htab->count) > htab->map.max_entries) {
                         atomic_dec(&htab->count);