* [PATCH bpf-next] netdevsim: fix overflow on the error path
@ 2018-01-27 3:50 Jakub Kicinski
2018-02-01 9:46 ` Simon Horman
2018-02-01 10:24 ` Daniel Borkmann
0 siblings, 2 replies; 3+ messages in thread
From: Jakub Kicinski @ 2018-01-27 3:50 UTC (permalink / raw)
To: daniel, alexei.starovoitov
Cc: dan.carpenter, netdev, oss-drivers, Jakub Kicinski
Undo loop condition on the error path would cause the i counter
to go below zero, if allocation failure happened with the first
(i.e. 0th) element of the array.
Fixes: 395cacb5f1a0 ("netdevsim: bpf: support fake map offload")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
---
drivers/net/netdevsim/bpf.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
index de73c1ff0939..75c25306d234 100644
--- a/drivers/net/netdevsim/bpf.c
+++ b/drivers/net/netdevsim/bpf.c
@@ -480,8 +480,7 @@ static int
nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap)
{
struct nsim_bpf_bound_map *nmap;
- unsigned int i;
- int err;
+ int i, err;
if (WARN_ON(offmap->map.map_type != BPF_MAP_TYPE_ARRAY &&
offmap->map.map_type != BPF_MAP_TYPE_HASH))
@@ -518,7 +517,7 @@ nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap)
return 0;
err_free:
- while (--i) {
+ while (--i >= 0) {
kfree(nmap->entry[i].key);
kfree(nmap->entry[i].value);
}
--
2.15.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next] netdevsim: fix overflow on the error path
2018-01-27 3:50 [PATCH bpf-next] netdevsim: fix overflow on the error path Jakub Kicinski
@ 2018-02-01 9:46 ` Simon Horman
2018-02-01 10:24 ` Daniel Borkmann
1 sibling, 0 replies; 3+ messages in thread
From: Simon Horman @ 2018-02-01 9:46 UTC (permalink / raw)
To: Jakub Kicinski
Cc: daniel, alexei.starovoitov, dan.carpenter, netdev, oss-drivers
On Fri, Jan 26, 2018 at 07:50:00PM -0800, Jakub Kicinski wrote:
> Undo loop condition on the error path would cause the i counter
> to go below zero, if allocation failure happened with the first
> (i.e. 0th) element of the array.
>
> Fixes: 395cacb5f1a0 ("netdevsim: bpf: support fake map offload")
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next] netdevsim: fix overflow on the error path
2018-01-27 3:50 [PATCH bpf-next] netdevsim: fix overflow on the error path Jakub Kicinski
2018-02-01 9:46 ` Simon Horman
@ 2018-02-01 10:24 ` Daniel Borkmann
1 sibling, 0 replies; 3+ messages in thread
From: Daniel Borkmann @ 2018-02-01 10:24 UTC (permalink / raw)
To: Jakub Kicinski, alexei.starovoitov; +Cc: dan.carpenter, netdev, oss-drivers
On 01/27/2018 04:50 AM, Jakub Kicinski wrote:
> Undo loop condition on the error path would cause the i counter
> to go below zero, if allocation failure happened with the first
> (i.e. 0th) element of the array.
>
> Fixes: 395cacb5f1a0 ("netdevsim: bpf: support fake map offload")
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Now that Linus has pulled everything, and we fast-forwarded bpf, applied
to bpf tree, thanks Jakub!
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-02-01 10:24 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-01-27 3:50 [PATCH bpf-next] netdevsim: fix overflow on the error path Jakub Kicinski
2018-02-01 9:46 ` Simon Horman
2018-02-01 10:24 ` Daniel Borkmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).