Unverified Commit b19a11b5 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14408 bpf: fix OOB devmap writes when deleting elements 

Merge Pull Request from: @ci-robot 
 
PR sync from: Tengda Wu <wutengda2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/XQD4BQGY3CAENPRMHP5SMOQ7P3RCYKUU/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBEAPP 
 
Link:https://gitee.com/openeuler/kernel/pulls/14408

 

Reviewed-by: default avatarYe Weihua <yeweihua4@huawei.com>
Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents c961654d 7eea4feb

kernel/bpf/devmap.c

+3 −3
Original line number Diff line number Diff line
@@ -180,7 +180,7 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr) 
static void dev_map_free(struct bpf_map *map)

{

	struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);

	int i;

	u32 i;



	/* At this point bpf_prog->aux->refcnt == 0 and this map->refcnt == 0,

	 * so the programs (can be more than one that used this map) were
@@ -813,7 +813,7 @@ static long dev_map_delete_elem(struct bpf_map *map, void *key) 
{

	struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);

	struct bpf_dtab_netdev *old_dev;

	int k = *(u32 *)key;

	u32 k = *(u32 *)key;



	if (k >= map->max_entries)

		return -EINVAL;
@@ -830,7 +830,7 @@ static long dev_map_hash_delete_elem(struct bpf_map *map, void *key) 
{

	struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);

	struct bpf_dtab_netdev *old_dev;

	int k = *(u32 *)key;

	u32 k = *(u32 *)key;

	unsigned long flags;

	int ret = -ENOENT;