Commit 412d2907 authored by David S. Miller's avatar David S. Miller

Merge branch 'bpf'

Alexei Starovoitov says:

====================
bpf: fix two bugs

Michael Holzheu caught two issues (in bpf syscall and in the test).
Fix them. Details in corresponding patches.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 600ddd68 ba1a68bf
...@@ -150,7 +150,7 @@ static int map_lookup_elem(union bpf_attr *attr) ...@@ -150,7 +150,7 @@ static int map_lookup_elem(union bpf_attr *attr)
int ufd = attr->map_fd; int ufd = attr->map_fd;
struct fd f = fdget(ufd); struct fd f = fdget(ufd);
struct bpf_map *map; struct bpf_map *map;
void *key, *value; void *key, *value, *ptr;
int err; int err;
if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM)) if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM))
...@@ -169,20 +169,29 @@ static int map_lookup_elem(union bpf_attr *attr) ...@@ -169,20 +169,29 @@ static int map_lookup_elem(union bpf_attr *attr)
if (copy_from_user(key, ukey, map->key_size) != 0) if (copy_from_user(key, ukey, map->key_size) != 0)
goto free_key; goto free_key;
err = -ENOENT; err = -ENOMEM;
rcu_read_lock(); value = kmalloc(map->value_size, GFP_USER);
value = map->ops->map_lookup_elem(map, key);
if (!value) if (!value)
goto err_unlock; goto free_key;
rcu_read_lock();
ptr = map->ops->map_lookup_elem(map, key);
if (ptr)
memcpy(value, ptr, map->value_size);
rcu_read_unlock();
err = -ENOENT;
if (!ptr)
goto free_value;
err = -EFAULT; err = -EFAULT;
if (copy_to_user(uvalue, value, map->value_size) != 0) if (copy_to_user(uvalue, value, map->value_size) != 0)
goto err_unlock; goto free_value;
err = 0; err = 0;
err_unlock: free_value:
rcu_read_unlock(); kfree(value);
free_key: free_key:
kfree(key); kfree(key);
err_put: err_put:
......
...@@ -69,9 +69,9 @@ static void test_hashmap_sanity(int i, void *data) ...@@ -69,9 +69,9 @@ static void test_hashmap_sanity(int i, void *data)
/* iterate over two elements */ /* iterate over two elements */
assert(bpf_get_next_key(map_fd, &key, &next_key) == 0 && assert(bpf_get_next_key(map_fd, &key, &next_key) == 0 &&
next_key == 2); (next_key == 1 || next_key == 2));
assert(bpf_get_next_key(map_fd, &next_key, &next_key) == 0 && assert(bpf_get_next_key(map_fd, &next_key, &next_key) == 0 &&
next_key == 1); (next_key == 1 || next_key == 2));
assert(bpf_get_next_key(map_fd, &next_key, &next_key) == -1 && assert(bpf_get_next_key(map_fd, &next_key, &next_key) == -1 &&
errno == ENOENT); errno == ENOENT);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment