Unverified Commit 051a322d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!13875 bpf: Fix out-of-bounds write in trie_get_next_key() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Xiaomeng Zhang <zhangxiaomeng13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6TXL7M6VDFZGGHIUM6TVPJRQFZ4F26TX/ 
 
https://gitee.com/openeuler/kernel/issues/IB379Y 
 
Link:https://gitee.com/openeuler/kernel/pulls/13875

 

Reviewed-by: default avatarYe Weihua <yeweihua4@huawei.com>
Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 66eb0830 6c0ef6ea

kernel/bpf/lpm_trie.c

+1 −1
Original line number Diff line number Diff line
@@ -665,7 +665,7 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key) 
	if (!key || key->prefixlen > trie->max_prefixlen)

		goto find_leftmost;



	node_stack = kmalloc_array(trie->max_prefixlen,

	node_stack = kmalloc_array(trie->max_prefixlen + 1,

				   sizeof(struct lpm_trie_node *),

				   GFP_ATOMIC | __GFP_NOWARN);

	if (!node_stack)