[PATCH bpf v2 0/2] bpf: Reject negative optlen in cgroup getsockopt hook

[Junseo Lim]

A cgroup getsockopt BPF program can set a negative optlen after the
kernel getsockopt handler has run. For TCP_ZEROCOPY_RECEIVE, the
kernel-buffer hook did not validate the lower bound and the negative
value could reach copy_to_sockptr() as a size_t.

Patch 1 rejects negative optlen values in the kernel-buffer hook.
Patch 2 adds a test_progs selftest that reproduces the issue through
TCP_ZEROCOPY_RECEIVE.

For patch 2, the userspace-visible errno is EFAULT on both fixed and
unfixed kernels, so the broken behavior cannot be detected from the
getsockopt() return value alone. The selftest exercises the problematic
path and can be used to reproduce the hardened usercopy warning on
unpatched kernels.

Changelog:
v1 -> v2:
- Add the selftest for negative optlen.
- Add Emil's Reviewed-by tag.
- Add Reported-by tag.

v1: https://lore.kernel.org/bpf/20260726070122.2407344-1-zirajs7@xxxxxxxxx/T/

Junseo Lim (2):
  bpf: Reject negative optlen in cgroup getsockopt hook
  selftests/bpf: Exercise negative optlen in cgroup getsockopt hook


 kernel/bpf/cgroup.c                           |  2 +-
 .../selftests/bpf/prog_tests/sockopt.c        | 22 +++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

-- 
2.55.0