[PATCH bpf 0/3] Add validation for bpf_set_retval helper

[PATCH bpf 0/3] Add validation for bpf_set_retval helper

[Xu Kuohai]

The bpf_set_retval() helper is used by cgroup BPF programs to set the
return value of the kernel hook. The argument type for this helper is
ARG_ANYTHING. This allows setting a positive value, which no cgroup
hook expects and can cause issues, such as the kernel panic reported
in [1].

This series adds validation for the argument of the bpf_set_retval()
helper.

For BPF_LSM_CGROUP, the same validation as BPF_LSM_MAC is enforced,
i.e. validate the argument against the LSM hook specific range, which
is returned by bpf_lsm_get_retval_range().

For all other cgroup program types, restrict the argument to
[-MAX_ERRNO, 0], which matches the kernel convention of 0 for success
and negative errno for error.

[1] https://lore.kernel.org/all/567d3206-74a5-44e5-99c6-779c425f399e@std.uestc.edu.cn

v3:
- Mark R1 as precise to prevent validation bypass via branch pruning (sashiko)

v2: https://lore.kernel.org/bpf/20260530055557.549474-1-xukuohai@huaweicloud.com/
- Extend validation from LSM cgroup BPF type to all cgroup BPF types (sashiko)

v1: https://lore.kernel.org/bpf/20260523085806.417723-1-xukuohai@huaweicloud.com/

Xu Kuohai (3):
  bpf: Add validation for bpf_set_retval argument
  selftests/bpf: Fix cgroup bpf tests broken by bpf_set_retval
    validation
  selftests/bpf: Add tests for bpf_set_retval validation

 kernel/bpf/verifier.c                         |  25 ++++
 .../selftests/bpf/prog_tests/verifier.c       |   2 +
 .../bpf/progs/cgroup_getset_retval_hooks.c    |   6 +-
 .../selftests/bpf/progs/sk_bypass_prot_mem.c  |   2 +
 .../selftests/bpf/progs/verifier_cgroup.c     | 114 ++++++++++++++++++
 5 files changed, 148 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/bpf/progs/verifier_cgroup.c

-- 
2.43.0

[PATCH bpf v3 1/3] bpf: Add validation for bpf_set_retval argument

[Xu Kuohai]

From: Xu Kuohai <xukuohai@huawei.com>

The bpf_set_retval() helper is used by cgroup BPF programs to set the
return value of the target hook. The argument type for this helper is
ARG_ANYTHING. This allows setting a positive value, which no cgroup
hook expects and can cause issues, such as:

- BPF_LSM_CGROUP: a positive value from bpf_lsm_socket_create bypasses
  the err < 0 check in __sock_create(), leaving the socket object
  unallocated. The positive return value is then propagated to the
  syscall entry __sys_socket(), which also bypasses the IS_ERR() guard
  and ultimately causes a NULL pointer dereference.

- BPF_CGROUP_DEVICE: a positive value can be returned through cgroup
  device bpf prog -> devcgroup_check_permission() -> bdev_permission()
  -> bdev_file_open_by_dev(), where ERR_PTR(positive) produces a pointer
  that IS_ERR() does not catch, leading to a wild pointer dereference.

- BPF_CGROUP_SOCK: a positive value can be returned through cgroup sock
  bpf prog -> __cgroup_bpf_run_filter_sk() -> inet_create() ->
  __sock_create(), where inet_create() frees the newly allocated sk
  via sk_common_release() and sets sock->sk = NULL on the non-zero
  return, but __sock_create() only checks err < 0 for cleanup, so a
  positive retval bypasses cleanup and returns a socket with NULL sk
  to userspace, triggering a NULL pointer dereference on subsequent
  socket operations.

- BPF_CGROUP_SYSCTL: a positive value can be returned through the cgroup
  bpf prog -> __cgroup_bpf_run_filter_sysctl() -> proc_sys_call_handler(),
  where a non-zero return bypasses the normal sysctl proc_handler and is
  returned directly to userspace as the read()/write() syscall return value.

So add validation for the argument of the bpf_set_retval() helper.

For BPF_LSM_CGROUP, the same validation as BPF_LSM_MAC is enforced,
i.e. validate the argument against the LSM hook specific range, which
is returned by bpf_lsm_get_retval_range().

For all other cgroup program types, restrict the argument to
[-MAX_ERRNO, 0], which matches the kernel convention of 0 for success
and negative errno for error.

Since the return value type is always int, also restrict the argument type
to scalar.

Fixes: b44123b4a3dc ("bpf: Add cgroup helpers bpf_{get,set}_retval to get/set syscall return value")
Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor")
Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn>
Closes: https://lore.kernel.org/all/567d3206-74a5-44e5-99c6-779c425f399e@std.uestc.edu.cn
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
---
 kernel/bpf/verifier.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 7fb88e1cd7c4..4948bd4bf9e1 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -10460,6 +10460,19 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
 		}
 		break;
 	case BPF_FUNC_set_retval:
+	{
+		struct bpf_retval_range range = {
+			.minval = -MAX_ERRNO,
+			.maxval = 0,
+			.return_32bit = true
+		};
+		struct bpf_reg_state *r1 = &regs[BPF_REG_1];
+
+		if (r1->type != SCALAR_VALUE) {
+			verbose(env, "R1 is not a scalar\n");
+			return -EINVAL;
+		}
+
 		if (prog_type == BPF_PROG_TYPE_LSM &&
 		    env->prog->expected_attach_type == BPF_LSM_CGROUP) {
 			if (!env->prog->aux->attach_func_proto->type) {
@@ -10469,8 +10482,20 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
 				verbose(env, "BPF_LSM_CGROUP that attach to void LSM hooks can't modify return value!\n");
 				return -EINVAL;
 			}
+			bpf_lsm_get_retval_range(env->prog, &range);
 		}
+
+		err = mark_chain_precision(env, BPF_REG_1);
+		if (err)
+			return err;
+
+		if (!retval_range_within(range, r1)) {
+			verbose_invalid_scalar(env, r1, range, "At bpf_set_retval", "R1");
+			return -EINVAL;
+		}
+
 		break;
+	}
 	case BPF_FUNC_dynptr_data:
 	{
 		struct bpf_reg_state *reg;
-- 
2.43.0

[PATCH bpf v3 2/3] selftests/bpf: Fix cgroup bpf tests broken by bpf_set_retval validation

[Xu Kuohai]

From: Xu Kuohai <xukuohai@huawei.com>

Add explicit return value checks for cgroup bpf progs rejected by the
bpf_set_retval validation.

Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
---
 .../selftests/bpf/progs/cgroup_getset_retval_hooks.c        | 6 +++++-
 tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c      | 2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/progs/cgroup_getset_retval_hooks.c b/tools/testing/selftests/bpf/progs/cgroup_getset_retval_hooks.c
index 13dfb4bbfd28..c0bfa2d12dc7 100644
--- a/tools/testing/selftests/bpf/progs/cgroup_getset_retval_hooks.c
+++ b/tools/testing/selftests/bpf/progs/cgroup_getset_retval_hooks.c
@@ -2,12 +2,16 @@
 
 #include <linux/bpf.h>
 #include <bpf/bpf_helpers.h>
+#include <errno.h>
+#include "err.h"
 
 #define BPF_RETVAL_HOOK(name, section, ctx, expected_err) \
 	__attribute__((__section__("?" section))) \
 	int name(struct ctx *_ctx) \
 	{ \
-		bpf_set_retval(bpf_get_retval()); \
+		int val = bpf_get_retval(); \
+		set_if_not_errno_or_zero(val, -EFAULT); \
+		bpf_set_retval(val); \
 		return 1; \
 	}
 
diff --git a/tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c b/tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c
index 09a00d11ffcc..bae5283fca6b 100644
--- a/tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c
+++ b/tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c
@@ -5,6 +5,7 @@
 #include <bpf/bpf_helpers.h>
 #include <bpf/bpf_tracing.h>
 #include <errno.h>
+#include "err.h"
 
 extern int tcp_memory_per_cpu_fw_alloc __ksym;
 extern int udp_memory_per_cpu_fw_alloc __ksym;
@@ -97,6 +98,7 @@ int sock_create(struct bpf_sock *ctx)
 	return 1;
 
 err:
+	set_if_not_errno_or_zero(err, -EFAULT);
 	bpf_set_retval(err);
 	return 0;
 }
-- 
2.43.0

Re: [PATCH bpf v3 2/3] selftests/bpf: Fix cgroup bpf tests broken by bpf_set_retval validation

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 739 bytes --]

> selftests/bpf: Fix cgroup bpf tests broken by bpf_set_retval validation
>
>     Add explicit return value checks for cgroup bpf progs rejected by the
>     bpf_set_retval validation.
>
>     Signed-off-by: Xu Kuohai <xukuohai@huawei.com>

This looks like a fix for tests that were broken by the bpf_set_retval
argument validation.  Should this include a Fixes: tag pointing at the
commit that introduced that validation?

  Fixes: 6792560b9eaa ("bpf: Add validation for bpf_set_retval argument")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/26681787206

Re: [PATCH bpf v3 2/3] selftests/bpf: Fix cgroup bpf tests broken by bpf_set_retval validation

[Emil Tsalapatis]

On Sat May 30, 2026 at 6:12 AM EDT, Xu Kuohai wrote:
> From: Xu Kuohai <xukuohai@huawei.com>
>
> Add explicit return value checks for cgroup bpf progs rejected by the
> bpf_set_retval validation.
>
> Signed-off-by: Xu Kuohai <xukuohai@huawei.com>

Since these tests are breaking with patch 1 you should put this patch
before them to avoid the breakage in the first place.

> ---
>  .../selftests/bpf/progs/cgroup_getset_retval_hooks.c        | 6 +++++-
>  tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c      | 2 ++
>  2 files changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/bpf/progs/cgroup_getset_retval_hooks.c b/tools/testing/selftests/bpf/progs/cgroup_getset_retval_hooks.c
> index 13dfb4bbfd28..c0bfa2d12dc7 100644
> --- a/tools/testing/selftests/bpf/progs/cgroup_getset_retval_hooks.c
> +++ b/tools/testing/selftests/bpf/progs/cgroup_getset_retval_hooks.c
> @@ -2,12 +2,16 @@
>  
>  #include <linux/bpf.h>
>  #include <bpf/bpf_helpers.h>
> +#include <errno.h>
> +#include "err.h"
>  
>  #define BPF_RETVAL_HOOK(name, section, ctx, expected_err) \
>  	__attribute__((__section__("?" section))) \
>  	int name(struct ctx *_ctx) \
>  	{ \
> -		bpf_set_retval(bpf_get_retval()); \
> +		int val = bpf_get_retval(); \
> +		set_if_not_errno_or_zero(val, -EFAULT); \
> +		bpf_set_retval(val); \
>  		return 1; \
>  	}
>  
> diff --git a/tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c b/tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c
> index 09a00d11ffcc..bae5283fca6b 100644
> --- a/tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c
> +++ b/tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c
> @@ -5,6 +5,7 @@
>  #include <bpf/bpf_helpers.h>
>  #include <bpf/bpf_tracing.h>
>  #include <errno.h>
> +#include "err.h"
>  
>  extern int tcp_memory_per_cpu_fw_alloc __ksym;
>  extern int udp_memory_per_cpu_fw_alloc __ksym;
> @@ -97,6 +98,7 @@ int sock_create(struct bpf_sock *ctx)
>  	return 1;
>  
>  err:
> +	set_if_not_errno_or_zero(err, -EFAULT);
>  	bpf_set_retval(err);
>  	return 0;
>  }

Re: [PATCH bpf v3 2/3] selftests/bpf: Fix cgroup bpf tests broken by bpf_set_retval validation

[Xu Kuohai]

On 6/1/2026 1:45 PM, Emil Tsalapatis wrote:
> On Sat May 30, 2026 at 6:12 AM EDT, Xu Kuohai wrote:
>> From: Xu Kuohai <xukuohai@huawei.com>
>>
>> Add explicit return value checks for cgroup bpf progs rejected by the
>> bpf_set_retval validation.
>>
>> Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
> 
> Since these tests are breaking with patch 1 you should put this patch
> before them to avoid the breakage in the first place.
>

Makes sense, thanks.

>> ---
>>   .../selftests/bpf/progs/cgroup_getset_retval_hooks.c        | 6 +++++-
>>   tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c      | 2 ++
>>   2 files changed, 7 insertions(+), 1 deletion(-)
>>
>> diff --git a/tools/testing/selftests/bpf/progs/cgroup_getset_retval_hooks.c b/tools/testing/selftests/bpf/progs/cgroup_getset_retval_hooks.c
>> index 13dfb4bbfd28..c0bfa2d12dc7 100644
>> --- a/tools/testing/selftests/bpf/progs/cgroup_getset_retval_hooks.c
>> +++ b/tools/testing/selftests/bpf/progs/cgroup_getset_retval_hooks.c
>> @@ -2,12 +2,16 @@
>>   
>>   #include <linux/bpf.h>
>>   #include <bpf/bpf_helpers.h>
>> +#include <errno.h>
>> +#include "err.h"
>>   
>>   #define BPF_RETVAL_HOOK(name, section, ctx, expected_err) \
>>   	__attribute__((__section__("?" section))) \
>>   	int name(struct ctx *_ctx) \
>>   	{ \
>> -		bpf_set_retval(bpf_get_retval()); \
>> +		int val = bpf_get_retval(); \
>> +		set_if_not_errno_or_zero(val, -EFAULT); \
>> +		bpf_set_retval(val); \
>>   		return 1; \
>>   	}
>>   
>> diff --git a/tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c b/tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c
>> index 09a00d11ffcc..bae5283fca6b 100644
>> --- a/tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c
>> +++ b/tools/testing/selftests/bpf/progs/sk_bypass_prot_mem.c
>> @@ -5,6 +5,7 @@
>>   #include <bpf/bpf_helpers.h>
>>   #include <bpf/bpf_tracing.h>
>>   #include <errno.h>
>> +#include "err.h"
>>   
>>   extern int tcp_memory_per_cpu_fw_alloc __ksym;
>>   extern int udp_memory_per_cpu_fw_alloc __ksym;
>> @@ -97,6 +98,7 @@ int sock_create(struct bpf_sock *ctx)
>>   	return 1;
>>   
>>   err:
>> +	set_if_not_errno_or_zero(err, -EFAULT);
>>   	bpf_set_retval(err);
>>   	return 0;
>>   }

[PATCH bpf v3 3/3] selftests/bpf: Add tests for bpf_set_retval validation

[Xu Kuohai]

From: Xu Kuohai <xukuohai@huawei.com>

Add verifier tests to validate bpf_set_retval argument for cgroup
program types.

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> #v1
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
---
 .../selftests/bpf/prog_tests/verifier.c       |   2 +
 .../selftests/bpf/progs/verifier_cgroup.c     | 114 ++++++++++++++++++
 2 files changed, 116 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/progs/verifier_cgroup.c

diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
index 06cd24e37b3f..d24d52a44425 100644
--- a/tools/testing/selftests/bpf/prog_tests/verifier.c
+++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
@@ -115,6 +115,7 @@
 #include "verifier_xdp.skel.h"
 #include "verifier_xdp_direct_packet_access.skel.h"
 #include "verifier_bits_iter.skel.h"
+#include "verifier_cgroup.skel.h"
 #include "verifier_lsm.skel.h"
 #include "verifier_jit_inline.skel.h"
 #include "irq.skel.h"
@@ -262,6 +263,7 @@ void test_verifier_xadd(void)                 { RUN(verifier_xadd); }
 void test_verifier_xdp(void)                  { RUN(verifier_xdp); }
 void test_verifier_xdp_direct_packet_access(void) { RUN(verifier_xdp_direct_packet_access); }
 void test_verifier_bits_iter(void) { RUN(verifier_bits_iter); }
+void test_verifier_cgroup(void)                { RUN(verifier_cgroup); }
 void test_verifier_lsm(void)                  { RUN(verifier_lsm); }
 void test_irq(void)			      { RUN(irq); }
 void test_verifier_mtu(void)		      { RUN(verifier_mtu); }
diff --git a/tools/testing/selftests/bpf/progs/verifier_cgroup.c b/tools/testing/selftests/bpf/progs/verifier_cgroup.c
new file mode 100644
index 000000000000..6a622801f4be
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/verifier_cgroup.c
@@ -0,0 +1,114 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf_sockopt_helpers.h>
+#include "bpf_misc.h"
+
+/*
+ * Cgroup programs set return values via bpf_set_retval() helper.
+ * The helper argument must be 0 (success) or negative errno.
+ * Positive values bypass IS_ERR() check and can cause kernel issues.
+ */
+
+SEC("lsm_cgroup/socket_create")
+__description("lsm_cgroup bpf_set_retval success")
+__success
+int BPF_PROG(lsm_cgroup_set_retval_zero_valid, int family, int type, int protocol, int kern)
+{
+	bpf_set_retval(0);
+	return 0;
+}
+
+SEC("lsm_cgroup/socket_create")
+__description("lsm_cgroup bpf_set_retval valid errno")
+__success
+int BPF_PROG(lsm_cgroup_set_retval_negative_valid, int family, int type, int protocol, int kern)
+{
+	bpf_set_retval(-12);
+	return 0;
+}
+
+SEC("lsm_cgroup/socket_create")
+__description("lsm_cgroup bpf_set_retval invalid negative value")
+__failure __msg("should have been in [-4095, 0]")
+int BPF_PROG(lsm_cgroup_set_retval_negative_invalid, int family, int type, int protocol, int kern)
+{
+	bpf_set_retval(-4096);
+	return 0;
+}
+
+SEC("lsm_cgroup/socket_create")
+__description("lsm_cgroup bpf_set_retval invalid positive value")
+__failure __msg("should have been in [-4095, 0]")
+int BPF_PROG(lsm_cgroup_set_retval_positive_invalid, int family, int type, int protocol, int kern)
+{
+	bpf_set_retval(1);
+	return 0;
+}
+
+SEC("cgroup/dev")
+__description("cgroup_device bpf_set_retval success")
+__success
+int cgroup_dev_set_retval_0(struct bpf_cgroup_dev_ctx *ctx)
+{
+	bpf_set_retval(0);
+	return 1;
+}
+
+SEC("cgroup/dev")
+__description("cgroup_device bpf_set_retval valid errno")
+__success
+int cgroup_dev_set_retval_neg_maxerrno(struct bpf_cgroup_dev_ctx *ctx)
+{
+	bpf_set_retval(-4095);
+	return 1;
+}
+
+SEC("cgroup/dev")
+__description("cgroup_device bpf_set_retval invalid positive value")
+__failure __msg("should have been in [-4095, 0]")
+int cgroup_dev_set_retval_1(struct bpf_cgroup_dev_ctx *ctx)
+{
+	bpf_set_retval(1);
+	return 1;
+}
+
+SEC("cgroup/dev")
+__description("cgroup_device bpf_set_retval invalid negative value")
+__failure __msg("should have been in [-4095, 0]")
+int cgroup_dev_set_retval_neg_4096(struct bpf_cgroup_dev_ctx *ctx)
+{
+	bpf_set_retval(-4096);
+	return 1;
+}
+
+SEC("cgroup/dev")
+__description("bpf_set_retval bounds check survives state pruning")
+__failure __msg("should have been in [-4095, 0]")
+__naked int cgroup_dev_set_retval_pruning_bypass(struct bpf_cgroup_dev_ctx *ctx)
+{
+	asm volatile (
+		"call %[bpf_get_prandom_u32];"
+		"if r0 != 0 goto 1f;"
+		"r0 = r0;"
+		"r0 = r0;"
+		"r0 = r0;"
+		"r0 = r0;"
+		"goto 2f;"
+	"1:"
+		"call %[bpf_get_prandom_u32];"
+	"2:"
+		"r1 = r0;"
+		"call %[bpf_set_retval];"
+		"r0 = 1;"
+		"exit;"
+		:
+		: __imm(bpf_get_prandom_u32),
+		  __imm(bpf_set_retval)
+		: __clobber_common
+	);
+}
+
+char _license[] SEC("license") = "GPL";
-- 
2.43.0