提交 f2a6f42e 编写于 作者: A Andrii Nakryiko 提交者: Zheng Zengkai

libbpf: Fix off-by-one bug in bpf_core_apply_relo()

mainline inclusion
from mainline-5.16-rc1
commit de5d0dce
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I5EUVD
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=de5d0dcef602de39070c31c7e56c58249c56ba37

-------------------------------------------------

Fix instruction index validity check which has off-by-one error.

Fixes: 3ee4f533 ("libbpf: Split bpf_core_apply_relo() into bpf_program independent helper.")
Signed-off-by: NAndrii Nakryiko <andrii@kernel.org>
Signed-off-by: NAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211025224531.1088894-2-andrii@kernel.org
(cherry picked from commit de5d0dce)
Signed-off-by: NWang Yufen <wangyufen@huawei.com>
上级 c2d5ec6e
...@@ -5343,7 +5343,7 @@ static int bpf_core_apply_relo(struct bpf_program *prog, ...@@ -5343,7 +5343,7 @@ static int bpf_core_apply_relo(struct bpf_program *prog,
* relocated, so it's enough to just subtract in-section offset * relocated, so it's enough to just subtract in-section offset
*/ */
insn_idx = insn_idx - prog->sec_insn_off; insn_idx = insn_idx - prog->sec_insn_off;
if (insn_idx > prog->insns_cnt) if (insn_idx >= prog->insns_cnt)
return -EINVAL; return -EINVAL;
insn = &prog->insns[insn_idx]; insn = &prog->insns[insn_idx];
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册