AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

netdevsim: fix overflow on the error path

Browse Source 
Undo loop condition on the error path would cause the i counter
to go below zero, if allocation failure happened with the first
(i.e. 0th) element of the array.

Fixes: 395cacb5f1 ("netdevsim: bpf: support fake map offload")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
This commit is contained in:
Jakub Kicinski 2018-01-26 19:50:00 -08:00 committed by Daniel Borkmann
parent b2fe5fa686
commit e029f54103
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/netdevsim/bpf.c
View File

@ -480,8 +480,7 @@ static int
nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap) nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap)
{ {
struct nsim_bpf_bound_map *nmap; struct nsim_bpf_bound_map *nmap;
unsigned int i; int i, err;
int err;
if (WARN_ON(offmap->map.map_type != BPF_MAP_TYPE_ARRAY && if (WARN_ON(offmap->map.map_type != BPF_MAP_TYPE_ARRAY &&
offmap->map.map_type != BPF_MAP_TYPE_HASH)) offmap->map.map_type != BPF_MAP_TYPE_HASH))
@ -518,7 +517,7 @@ nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap)
return 0; return 0;
err_free: err_free:
while (--i) { while (--i >= 0) {
kfree(nmap->entry[i].key); kfree(nmap->entry[i].key);
kfree(nmap->entry[i].value); kfree(nmap->entry[i].value);
} }