]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
bpf: Fix exact match conditions in trie_get_next_key()
authorHou Tao <houtao1@huawei.com>
Fri, 6 Dec 2024 11:06:18 +0000 (19:06 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 14 Dec 2024 18:51:31 +0000 (19:51 +0100)
commiteb6a5262ec66a87710f1a05673ed4f3225a4e839
tree28c8d7b5c9ff89edfe6282ce1e6c990ca35e2cfe
parent6155fac6d9ae8875db2b45611727f8bc969a8826
bpf: Fix exact match conditions in trie_get_next_key()

[ Upstream commit 27abc7b3fa2e09bbe41e2924d328121546865eda ]

trie_get_next_key() uses node->prefixlen == key->prefixlen to identify
an exact match, However, it is incorrect because when the target key
doesn't fully match the found node (e.g., node->prefixlen != matchlen),
these two nodes may also have the same prefixlen. It will return
expected result when the passed key exist in the trie. However when a
recently-deleted key or nonexistent key is passed to
trie_get_next_key(), it may skip keys and return incorrect result.

Fix it by using node->prefixlen == matchlen to identify exact matches.
When the condition is true after the search, it also implies
node->prefixlen equals key->prefixlen, otherwise, the search would
return NULL instead.

Fixes: b471f2f1de8b ("bpf: implement MAP_GET_NEXT_KEY command for LPM_TRIE map")
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20241206110622.1161752-6-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
kernel/bpf/lpm_trie.c