diff options
| author | Byeonguk Jeong <jungbu2855@gmail.com> | 2024-10-26 14:02:43 +0900 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2024-10-29 13:41:40 -0700 |
| commit | 13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21 (patch) | |
| tree | cda75874d697a484f3860d50709212ecb1ace4da /kernel/locking/test-ww_mutex.c | |
| parent | 1fb315892d8395cec2dae04b0cb5558731aefb37 (diff) | |
bpf: Fix out-of-bounds write in trie_get_next_key()
trie_get_next_key() allocates a node stack with size trie->max_prefixlen,
while it writes (trie->max_prefixlen + 1) nodes to the stack when it has
full paths from the root to leaves. For example, consider a trie with
max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ...
0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with
.prefixlen = 8 make 9 nodes be written on the node stack with size 8.
Fixes: b471f2f1de8b ("bpf: implement MAP_GET_NEXT_KEY command for LPM_TRIE map")
Signed-off-by: Byeonguk Jeong <jungbu2855@gmail.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@kernel.org>
Tested-by: Hou Tao <houtao1@huawei.com>
Acked-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/Zxx384ZfdlFYnz6J@localhost.localdomain
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel/locking/test-ww_mutex.c')
0 files changed, 0 insertions, 0 deletions