Re: [PATCH bpf] bpf: Reject negative optlen in cgroup getsockopt hook

[임준서]

Thanks for the review.

The reproducer already sets ctx->optlen to a negative value (-11) in
the cgroup BPF program:

/* ctx->optlen = -11; */
BPF_MOV64_IMM(BPF_REG_2, -11),
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_2,
            offsetof(struct bpf_sockopt, optlen)),

https://gist.github.com/ZirAjs/a177ec6d8f2c8ed7d93edca6313a9255

The PASS/FAIL output only checks the behavior before and after applying the
patch. Without the patch, the negative value reaches copy_to_sockptr() and
triggers the warning. With the patch, getsockopt() rejects it with -EFAULT.

Would you prefer that I include the reproducer directly in the patch
submission rather than only linking to the gist?

On Thu, Jul 30, 2026 at 6:36 AM Emil Tsalapatis <emil@xxxxxxxxxxxxxxx> wrote:
>
> On Sun Jul 26, 2026 at 3:01 AM EDT, Junseo Lim wrote:
> > A cgroup getsockopt BPF program can shrink ctx->optlen after the
> > kernel getsockopt handler has run. The kernel-buffer variant, used by
> > TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original
> > length.
> >
> > If BPF writes a negative optlen, that value is accepted and propagated
> > back to the TCP getsockopt code. It can then be passed to
> > copy_to_sockptr() as a size_t and trigger the hardened usercopy
> > bytes > INT_MAX warning.
> >
> > Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(),
> > matching the lower-bound validation already present in the sockptr-based
> > getsockopt hook.
> >
> > Fixes: 9cacf81f8161 ("bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE")
> > Signed-off-by: Junseo Lim <zirajs7@xxxxxxxxx>
>
> Reviewed-by: Emil Tsalapatis <emil@xxxxxxxxxxxxxxx>
>
> It'd be worth resending with a reproducer setting optlen to negative.
>
> > ---
> > Reproducer and warning:
> > https://gist.github.com/ZirAjs/a177ec6d8f2c8ed7d93edca6313a9255
> >
> > Tested by building and booting the patched kernel. The reproducer
> > returns -EFAULT and no longer triggers the hardened usercopy warning.
> >
> >  kernel/bpf/cgroup.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
> > index 4355ccb78a9c..c04a244fe2e6 100644
> > --- a/kernel/bpf/cgroup.c
> > +++ b/kernel/bpf/cgroup.c
> > @@ -2235,7 +2235,7 @@ int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level,
> >       if (ret < 0)
> >               return ret;
> >
> > -     if (ctx.optlen > *optlen)
> > +     if (ctx.optlen > *optlen || ctx.optlen < 0)
> >               return -EFAULT;
> >
> >       /* BPF programs can shrink the buffer, export the modifications.
>