Re: [PATCH bpf] bpf: Reject negative optlen in cgroup getsockopt hook

[Emil Tsalapatis]

On Sun Jul 26, 2026 at 3:01 AM EDT, Junseo Lim wrote:
> A cgroup getsockopt BPF program can shrink ctx->optlen after the
> kernel getsockopt handler has run. The kernel-buffer variant, used by
> TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original
> length.
>
> If BPF writes a negative optlen, that value is accepted and propagated
> back to the TCP getsockopt code. It can then be passed to
> copy_to_sockptr() as a size_t and trigger the hardened usercopy
> bytes > INT_MAX warning.
>
> Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(),
> matching the lower-bound validation already present in the sockptr-based
> getsockopt hook.
>
> Fixes: 9cacf81f8161 ("bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE")
> Signed-off-by: Junseo Lim <zirajs7@xxxxxxxxx>

Reviewed-by: Emil Tsalapatis <emil@xxxxxxxxxxxxxxx>

It'd be worth resending with a reproducer setting optlen to negative.

> ---
> Reproducer and warning: 
> https://gist.github.com/ZirAjs/a177ec6d8f2c8ed7d93edca6313a9255
>
> Tested by building and booting the patched kernel. The reproducer 
> returns -EFAULT and no longer triggers the hardened usercopy warning.
>
>  kernel/bpf/cgroup.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
> index 4355ccb78a9c..c04a244fe2e6 100644
> --- a/kernel/bpf/cgroup.c
> +++ b/kernel/bpf/cgroup.c
> @@ -2235,7 +2235,7 @@ int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level,
>  	if (ret < 0)
>  		return ret;
>  
> -	if (ctx.optlen > *optlen)
> +	if (ctx.optlen > *optlen || ctx.optlen < 0)
>  		return -EFAULT;
>  
>  	/* BPF programs can shrink the buffer, export the modifications.