diff options
| author | Alexei Starovoitov <ast@kernel.org> | 2026-04-05 18:45:05 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-04-05 18:45:06 -0700 |
| commit | c6095cb9684e278a59cb5a25deff6bfef9aecf27 (patch) | |
| tree | 315465f33f330ac4aa8ef2009651b978dccbb505 /kernel | |
| parent | 24dbbf8a2343d4063c370a1f25645eabc50d68c9 (diff) | |
| parent | 262b857da6bee528420514690895ed7d2c65077e (diff) | |
| download | linux-c6095cb9684e278a59cb5a25deff6bfef9aecf27.tar.gz linux-c6095cb9684e278a59cb5a25deff6bfef9aecf27.zip | |
Merge branch 'bpf-fix-end-of-list-detection-in-cgroup_storage_get_next_key'
Weiming Shi says:
====================
bpf: fix end-of-list detection in cgroup_storage_get_next_key()
list_next_entry() never returns NULL, so the NULL check in
cgroup_storage_get_next_key() is dead code. When iterating past the last
element, the function reads storage->key from a bogus pointer that aliases
internal map fields and copies the result to userspace.
Patch 1 replaces the NULL check with list_entry_is_head() so the function
correctly returns -ENOENT when there are no more entries.
Patch 2 adds a selftest to cover this corner case, as suggested by Sun Jian
and Paul Chaignon.
v2:
- Added selftest (Paul Chaignon)
- Collected Reviewed-by and Acked-by tags
====================
Link: https://patch.msgid.link/20260403132951.43533-1-bestswngs@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/local_storage.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/bpf/local_storage.c b/kernel/bpf/local_storage.c index 8fca0c64f7b1..23267213a17f 100644 --- a/kernel/bpf/local_storage.c +++ b/kernel/bpf/local_storage.c @@ -270,7 +270,7 @@ static int cgroup_storage_get_next_key(struct bpf_map *_map, void *key, goto enoent; storage = list_next_entry(storage, list_map); - if (!storage) + if (list_entry_is_head(storage, &map->list, list_map)) goto enoent; } else { storage = list_first_entry(&map->list, |