Unverified Commit 0912fd81 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14409 bpf: fix OOB devmap writes when deleting elements 

Merge Pull Request from: @ci-robot 
 
PR sync from: Tengda Wu <wutengda2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/NV25372HV2LKSLKVAJW4SEYHRZV2BCZN/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBEAPP 
 
Link:https://gitee.com/openeuler/kernel/pulls/14409

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Reviewed-by: default avatarYe Weihua <yeweihua4@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents 46cc5a24 907dd35f

kernel/bpf/devmap.c

+3 −3
Original line number Diff line number Diff line
@@ -198,7 +198,7 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr) 
static void dev_map_free(struct bpf_map *map)

{

	struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);

	int i;

	u32 i;



	/* At this point bpf_prog->aux->refcnt == 0 and this map->refcnt == 0,

	 * so the programs (can be more than one that used this map) were
@@ -557,7 +557,7 @@ static int dev_map_delete_elem(struct bpf_map *map, void *key) 
{

	struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);

	struct bpf_dtab_netdev *old_dev;

	int k = *(u32 *)key;

	u32 k = *(u32 *)key;



	if (k >= map->max_entries)

		return -EINVAL;
@@ -579,7 +579,7 @@ static int dev_map_hash_delete_elem(struct bpf_map *map, void *key) 
{

	struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);

	struct bpf_dtab_netdev *old_dev;

	int k = *(u32 *)key;

	u32 k = *(u32 *)key;

	unsigned long flags;

	int ret = -ENOENT;