Unverified Commit 4d48400e authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14919 bpf: fix OOB devmap writes when deleting elements 

Merge Pull Request from: @ci-robot 
 
PR sync from: Tengda Wu <wutengda2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/PLPI22OEZLRRYKL7QRYYZS2DAAZ6ICEM/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBIOCY 
 
Link:https://gitee.com/openeuler/kernel/pulls/14919

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Reviewed-by: default avatarYe Weihua <yeweihua4@huawei.com>
Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents fdf62dff 06e1a64e

kernel/bpf/devmap.c

+3 −2
Original line number Diff line number Diff line
@@ -147,7 +147,8 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr) 
static void dev_map_free(struct bpf_map *map)

{

	struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);

	int i, cpu;

	int cpu;

	u32 i;



	/* At this point bpf_prog->aux->refcnt == 0 and this map->refcnt == 0,

	 * so the programs (can be more than one that used this map) were
@@ -418,7 +419,7 @@ static int dev_map_delete_elem(struct bpf_map *map, void *key) 
{

	struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);

	struct bpf_dtab_netdev *old_dev;

	int k = *(u32 *)key;

	u32 k = *(u32 *)key;



	if (k >= map->max_entries)

		return -EINVAL;