[PATCH bpf-next] bpf: Fix stream capacity leak and spurious -ENOSPC in bpf_stream_stage_commit

[Khawar Ahemad]

bpf_stream_stage_commit() accounts the staged string length against
the stream capacity via bpf_stream_consume_capacity() before
detaching the queued elements with llist_del_all().

If no elements are returned by llist_del_all() (for instance, when
the staging list was empty or failed to allocate elements), the
function returns early without releasing the consumed capacity.
Because no elements are queued into stream->log, no reader will ever
pop or release this capacity, leading to a permanent capacity leak.

Furthermore, if ss->len is 0, bpf_stream_consume_capacity() is invoked
needlessly and fails with -ENOSPC if the stream is currently at
capacity, spuriously rejecting a zero-byte commit.

Fix both issues by:
1. Returning early if ss->len is 0.
2. Rolling back the consumed capacity with bpf_stream_release_capacity()
   if llist_del_all() returns NULL.

Fixes: 5ab154f1463a ("bpf: Introduce BPF standard streams")
Signed-off-by: Khawar Ahemad <ahemadkhawar123@xxxxxxxxx>
---
 kernel/bpf/stream.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/kernel/bpf/stream.c b/kernel/bpf/stream.c
index 7a5c3ac867..3ad58c8284 100644
--- a/kernel/bpf/stream.c
+++ b/kernel/bpf/stream.c
@@ -350,15 +350,21 @@ int bpf_stream_stage_commit(struct bpf_stream_stage *ss, struct bpf_prog *prog,
 	if (!stream)
 		return -EINVAL;
 
+	if (!ss->len)
+		return 0;
+
 	ret = bpf_stream_consume_capacity(stream, ss->len);
 	if (ret)
 		return ret;
 
 	list = llist_del_all(&ss->log);
-	head = tail = list;
-
-	if (!list)
+	if (!list) {
+		bpf_stream_release_capacity(stream, ss->len);
 		return 0;
+	}
+
+	head = list;
+	tail = list;
 	while (llist_next(list)) {
 		tail = llist_next(list);
 		list = tail;
-- 
2.54.0 (Apple Git-157)