Weiming Shi 0f3d9dd5e1 bpf: fix end-of-list detection in cgroup_storage_get_next_key() ...

[ Upstream commit 5828b9e5b2 ]

list_next_entry() never returns NULL -- when the current element is the
last entry it wraps to the list head via container_of(). The subsequent
NULL check is therefore dead code and get_next_key() never returns
-ENOENT for the last element, instead reading storage->key from a bogus
pointer that aliases internal map fields and copying the result to
userspace.

Replace it with list_entry_is_head() so the function correctly returns
-ENOENT when there are no more entries.

Fixes: de9cbbaadb ("bpf: introduce cgroup storage maps")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Sun Jian <sun.jian.kdev@gmail.com>
Acked-by: Paul Chaignon <paul.chaignon@gmail.com>
Link: https://lore.kernel.org/r/20260403132951.43533-2-bestswngs@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-06-01 17:29:30 +02:00

..

preload

…

arraymap.c

…

bpf_inode_storage.c

…

bpf_iter.c

…

bpf_local_storage.c

…

bpf_lru_list.c

…

bpf_lru_list.h

…

bpf_lsm.c

…

bpf_struct_ops_types.h

…

bpf_struct_ops.c

…

btf.c

…

cgroup.c

bpf: Reject narrower access to pointer ctx fields

2026-02-06 16:40:09 +01:00

core.c

bpf: fix potential error return

2025-01-09 13:25:05 +01:00

cpumap.c

…

devmap.c

bpf: fix OOB devmap writes when deleting elements

2024-12-14 19:48:24 +01:00

disasm.c

…

disasm.h

…

dispatcher.c

…

hashtab.c

…

helpers.c

bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers

2025-05-02 07:41:07 +02:00

inode.c

…

local_storage.c

bpf: fix end-of-list detection in cgroup_storage_get_next_key()

2026-06-01 17:29:30 +02:00

lpm_trie.c

bpf: Fix exact match conditions in trie_get_next_key()

2024-12-14 19:48:22 +01:00

Makefile

…

map_in_map.c

…

map_in_map.h

…

map_iter.c

…

net_namespace.c

…

offload.c

…

percpu_freelist.c

…

percpu_freelist.h

…

prog_iter.c

…

queue_stack_maps.c

…

reuseport_array.c

…

ringbuf.c

bpf: Sync pending IRQ work before freeing ring buffer

2025-12-07 06:08:07 +09:00

stackmap.c

…

syscall.c

bpf: avoid holding freeze_mutex during mmap operation

2025-05-02 07:41:06 +02:00

sysfs_btf.c

…

task_iter.c

…

tnum.c

…

trampoline.c

…

verifier.c

bpf: Fix regsafe() for pointers to packet

2026-04-18 10:31:09 +02:00