Re: [PATCH bpf] bpf: Reject negative optlen in cgroup getsockopt hook

[Daniel Borkmann]

On 8/1/26 10:26 AM, 임준서 wrote:
> Thanks for the review.
>
> The reproducer already sets ctx->optlen to a negative value (-11) in
> the cgroup BPF program:
>
> /* ctx->optlen = -11; */
> BPF_MOV64_IMM(BPF_REG_2, -11),
> BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_2,
>              offsetof(struct bpf_sockopt, optlen)),
>
> https://gist.github.com/ZirAjs/a177ec6d8f2c8ed7d93edca6313a9255
>
> The PASS/FAIL output only checks the behavior before and after applying the
> patch. Without the patch, the negative value reaches copy_to_sockptr() and
> triggers the warning. With the patch, getsockopt() rejects it with -EFAULT.
>
> Would you prefer that I include the reproducer directly in the patch
> submission rather than only linking to the gist?
Yes, please add it as 2nd commit and check git log on how to integrate it
into test_progs (tools/testing/selftests/bpf/) so it can run via CI.

Thanks,
Daniel