Unverified Commit bce76101 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!13328 bpf: Fix out-of-bounds write in trie_get_next_key() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Xiaomeng Zhang <zhangxiaomeng13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/TMGLML7MJC6GEKRODXNQTISBO7XHX6Q7/ 
 
https://gitee.com/openeuler/kernel/issues/IB4U3C 
 
Link:https://gitee.com/openeuler/kernel/pulls/13328

 

Reviewed-by: default avatarYe Weihua <yeweihua4@huawei.com>
Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 6f584fed 9790a34c

kernel/bpf/lpm_trie.c

+1 −1
Original line number Diff line number Diff line
@@ -655,7 +655,7 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key) 
	if (!key || key->prefixlen > trie->max_prefixlen)

		goto find_leftmost;



	node_stack = kmalloc_array(trie->max_prefixlen,

	node_stack = kmalloc_array(trie->max_prefixlen + 1,

				   sizeof(struct lpm_trie_node *),

				   GFP_ATOMIC | __GFP_NOWARN);

	if (!node_stack)