[PATCH bpf v2 0/2] bpf: fix end-of-list detection in cgroup_storage_get_next_key()

[Weiming Shi <bestswngs@gmail.com>]

list_next_entry() never returns NULL, so the NULL check in
cgroup_storage_get_next_key() is dead code. When iterating past the last
element, the function reads storage->key from a bogus pointer that aliases
internal map fields and copies the result to userspace.

Patch 1 replaces the NULL check with list_entry_is_head() so the function
correctly returns -ENOENT when there are no more entries.

Patch 2 adds a selftest to cover this corner case, as suggested by Sun Jian
and Paul Chaignon.

v2:
  - Added selftest (Paul Chaignon)
  - Collected Reviewed-by and Acked-by tags

Weiming Shi (2):
  bpf: fix end-of-list detection in cgroup_storage_get_next_key()
  selftests/bpf: add get_next_key boundary test for cgroup_storage

 kernel/bpf/local_storage.c                              | 2 +-
 tools/testing/selftests/bpf/prog_tests/cgroup_storage.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

-- 
2.43.0