diff options
| author | Jakub Kicinski <jakub.kicinski@netronome.com> | 2018-01-26 19:50:00 -0800 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2018-02-01 11:22:51 +0100 |
| commit | e029f541039ff0768960ede62b946bcf4a163dec (patch) | |
| tree | fb307180cdbf3d5b7e73aae639b8eef7a4aa08c0 /drivers/net | |
| parent | b2fe5fa68642860e7de76167c3111623aa0d5de1 (diff) | |
| download | linux-e029f541039ff0768960ede62b946bcf4a163dec.tar.gz linux-e029f541039ff0768960ede62b946bcf4a163dec.tar.bz2 linux-e029f541039ff0768960ede62b946bcf4a163dec.zip | |
netdevsim: fix overflow on the error path
Undo loop condition on the error path would cause the i counter
to go below zero, if allocation failure happened with the first
(i.e. 0th) element of the array.
Fixes: 395cacb5f1a0 ("netdevsim: bpf: support fake map offload")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/netdevsim/bpf.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c index de73c1ff0939..75c25306d234 100644 --- a/drivers/net/netdevsim/bpf.c +++ b/drivers/net/netdevsim/bpf.c @@ -480,8 +480,7 @@ static int nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap) { struct nsim_bpf_bound_map *nmap; - unsigned int i; - int err; + int i, err; if (WARN_ON(offmap->map.map_type != BPF_MAP_TYPE_ARRAY && offmap->map.map_type != BPF_MAP_TYPE_HASH)) @@ -518,7 +517,7 @@ nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap) return 0; err_free: - while (--i) { + while (--i >= 0) { kfree(nmap->entry[i].key); kfree(nmap->entry[i].value); } |