On Fri, Nov 04, 2022 at 12:39:55AM +0530, Kumar Kartikeya Dwivedi wrote:
> else
> @@ -311,11 +344,12 @@ static inline void __copy_map_value(struct bpf_map *map, void *dst, void *src, b
> return;
> }
>
> - for (i = 0; i < map->off_arr->cnt; i++) {
> - u32 next_off = map->off_arr->field_off[i];
> + for (i = 0; i < map->field_offs->cnt; i++) {
> + u32 next_off = map->field_offs->field_off[i];
> + u32 sz = next_off - curr_off;
>
> - memcpy(dst + curr_off, src + curr_off, next_off - curr_off);
> - curr_off += map->off_arr->field_sz[i];
> + memcpy(dst + curr_off, src + curr_off, sz);
> + curr_off += map->field_offs->field_sz[i] + sz;
This is a clear bug. The kernel is crashing with this change.
How did you test this?
> }
> memcpy(dst + curr_off, src + curr_off, map->value_size - curr_off);
> }
> @@ -335,16 +369,17 @@ static inline void zero_map_value(struct bpf_map *map, void *dst)
> u32 curr_off = 0;
> int i;
>
> - if (likely(!map->off_arr)) {
> + if (likely(!map->field_offs)) {
> memset(dst, 0, map->value_size);
> return;
> }
>
> - for (i = 0; i < map->off_arr->cnt; i++) {
> - u32 next_off = map->off_arr->field_off[i];
> + for (i = 0; i < map->field_offs->cnt; i++) {
> + u32 next_off = map->field_offs->field_off[i];
> + u32 sz = next_off - curr_off;
>
> - memset(dst + curr_off, 0, next_off - curr_off);
> - curr_off += map->off_arr->field_sz[i];
> + memset(dst + curr_off, 0, sz);
> + curr_off += map->field_offs->field_sz[i] + sz;
same thing
