bpf: Fix exact match conditions in trie_get_next_key()

[ Upstream commit 27abc7b3fa2e09bbe41e2924d328121546865eda ]

trie_get_next_key() uses node->prefixlen == key->prefixlen to identify
an exact match, However, it is incorrect because when the target key
doesn't fully match the found node (e.g., node->prefixlen != matchlen),
these two nodes may also have the same prefixlen. It will return
expected result when the passed key exist in the trie. However when a
recently-deleted key or nonexistent key is passed to
trie_get_next_key(), it may skip keys and return incorrect result.

Fix it by using node->prefixlen == matchlen to identify exact matches.
When the condition is true after the search, it also implies
node->prefixlen equals key->prefixlen, otherwise, the search would
return NULL instead.

Fixes: b471f2f1de8b ("bpf: implement MAP_GET_NEXT_KEY command for LPM_TRIE map")
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20241206110622.1161752-6-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index 0ab0ad989eaff1327ccaa5a3dda817bea9c00244..37669d698866409293d9d59b08e8039cf9fec1f9 100644 (file)
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c
@@ -639,7 +639,7 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key)
        struct lpm_trie_node **node_stack = NULL;
        int err = 0, stack_ptr = -1;
        unsigned int next_bit;
-       size_t matchlen;
+       size_t matchlen = 0;
 
        /* The get_next_key follows postorder. For the 4 node example in
         * the top of this file, the trie_get_next_key() returns the following
@@ -678,7 +678,7 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key)
                next_bit = extract_bit(key->data, node->prefixlen);
                node = rcu_dereference(node->child[next_bit]);
        }
-       if (!node || node->prefixlen != key->prefixlen ||
+       if (!node || node->prefixlen != matchlen ||
            (node->flags & LPM_TREE_NODE_FLAG_IM))
                goto find_leftmost;