[PATCH bpf] bpf: Reject negative optlen in cgroup getsockopt hook

[PATCH bpf] bpf: Reject negative optlen in cgroup getsockopt hook

[Junseo Lim]

A cgroup getsockopt BPF program can shrink ctx->optlen after the
kernel getsockopt handler has run. The kernel-buffer variant, used by
TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original
length.

If BPF writes a negative optlen, that value is accepted and propagated
back to the TCP getsockopt code. It can then be passed to
copy_to_sockptr() as a size_t and trigger the hardened usercopy
bytes > INT_MAX warning.

Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(),
matching the lower-bound validation already present in the sockptr-based
getsockopt hook.

Fixes: 9cacf81f8161 ("bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE")
Signed-off-by: Junseo Lim <zirajs7@gmail.com>
---
Reproducer and warning: 
https://gist.github.com/ZirAjs/a177ec6d8f2c8ed7d93edca6313a9255

Tested by building and booting the patched kernel. The reproducer 
returns -EFAULT and no longer triggers the hardened usercopy warning.

 kernel/bpf/cgroup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 4355ccb78a9c..c04a244fe2e6 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -2235,7 +2235,7 @@ int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level,
 	if (ret < 0)
 		return ret;
 
-	if (ctx.optlen > *optlen)
+	if (ctx.optlen > *optlen || ctx.optlen < 0)
 		return -EFAULT;
 
 	/* BPF programs can shrink the buffer, export the modifications.
-- 
2.55.0

Re: [PATCH bpf] bpf: Reject negative optlen in cgroup getsockopt hook

[Emil Tsalapatis]

On Sun Jul 26, 2026 at 3:01 AM EDT, Junseo Lim wrote:
> A cgroup getsockopt BPF program can shrink ctx->optlen after the
> kernel getsockopt handler has run. The kernel-buffer variant, used by
> TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original
> length.
>
> If BPF writes a negative optlen, that value is accepted and propagated
> back to the TCP getsockopt code. It can then be passed to
> copy_to_sockptr() as a size_t and trigger the hardened usercopy
> bytes > INT_MAX warning.
>
> Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(),
> matching the lower-bound validation already present in the sockptr-based
> getsockopt hook.
>
> Fixes: 9cacf81f8161 ("bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE")
> Signed-off-by: Junseo Lim <zirajs7@gmail.com>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

It'd be worth resending with a reproducer setting optlen to negative.

> ---
> Reproducer and warning: 
> https://gist.github.com/ZirAjs/a177ec6d8f2c8ed7d93edca6313a9255
>
> Tested by building and booting the patched kernel. The reproducer 
> returns -EFAULT and no longer triggers the hardened usercopy warning.
>
>  kernel/bpf/cgroup.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
> index 4355ccb78a9c..c04a244fe2e6 100644
> --- a/kernel/bpf/cgroup.c
> +++ b/kernel/bpf/cgroup.c
> @@ -2235,7 +2235,7 @@ int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level,
>  	if (ret < 0)
>  		return ret;
>  
> -	if (ctx.optlen > *optlen)
> +	if (ctx.optlen > *optlen || ctx.optlen < 0)
>  		return -EFAULT;
>  
>  	/* BPF programs can shrink the buffer, export the modifications.

Re: [PATCH bpf] bpf: Reject negative optlen in cgroup getsockopt hook

[임준서]

Thanks for the review.

The reproducer already sets ctx->optlen to a negative value (-11) in
the cgroup BPF program:

/* ctx->optlen = -11; */
BPF_MOV64_IMM(BPF_REG_2, -11),
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_2,
            offsetof(struct bpf_sockopt, optlen)),

https://gist.github.com/ZirAjs/a177ec6d8f2c8ed7d93edca6313a9255

The PASS/FAIL output only checks the behavior before and after applying the
patch. Without the patch, the negative value reaches copy_to_sockptr() and
triggers the warning. With the patch, getsockopt() rejects it with -EFAULT.

Would you prefer that I include the reproducer directly in the patch
submission rather than only linking to the gist?

On Thu, Jul 30, 2026 at 6:36 AM Emil Tsalapatis <emil@etsalapatis.com> wrote:
>
> On Sun Jul 26, 2026 at 3:01 AM EDT, Junseo Lim wrote:
> > A cgroup getsockopt BPF program can shrink ctx->optlen after the
> > kernel getsockopt handler has run. The kernel-buffer variant, used by
> > TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original
> > length.
> >
> > If BPF writes a negative optlen, that value is accepted and propagated
> > back to the TCP getsockopt code. It can then be passed to
> > copy_to_sockptr() as a size_t and trigger the hardened usercopy
> > bytes > INT_MAX warning.
> >
> > Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(),
> > matching the lower-bound validation already present in the sockptr-based
> > getsockopt hook.
> >
> > Fixes: 9cacf81f8161 ("bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE")
> > Signed-off-by: Junseo Lim <zirajs7@gmail.com>
>
> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
>
> It'd be worth resending with a reproducer setting optlen to negative.
>
> > ---
> > Reproducer and warning:
> > https://gist.github.com/ZirAjs/a177ec6d8f2c8ed7d93edca6313a9255
> >
> > Tested by building and booting the patched kernel. The reproducer
> > returns -EFAULT and no longer triggers the hardened usercopy warning.
> >
> >  kernel/bpf/cgroup.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
> > index 4355ccb78a9c..c04a244fe2e6 100644
> > --- a/kernel/bpf/cgroup.c
> > +++ b/kernel/bpf/cgroup.c
> > @@ -2235,7 +2235,7 @@ int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level,
> >       if (ret < 0)
> >               return ret;
> >
> > -     if (ctx.optlen > *optlen)
> > +     if (ctx.optlen > *optlen || ctx.optlen < 0)
> >               return -EFAULT;
> >
> >       /* BPF programs can shrink the buffer, export the modifications.
>

Re: [PATCH bpf] bpf: Reject negative optlen in cgroup getsockopt hook

[Daniel Borkmann]

On 8/1/26 10:26 AM, 임준서 wrote:
> Thanks for the review.
> 
> The reproducer already sets ctx->optlen to a negative value (-11) in
> the cgroup BPF program:
> 
> /* ctx->optlen = -11; */
> BPF_MOV64_IMM(BPF_REG_2, -11),
> BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_2,
>              offsetof(struct bpf_sockopt, optlen)),
> 
> https://gist.github.com/ZirAjs/a177ec6d8f2c8ed7d93edca6313a9255
> 
> The PASS/FAIL output only checks the behavior before and after applying the
> patch. Without the patch, the negative value reaches copy_to_sockptr() and
> triggers the warning. With the patch, getsockopt() rejects it with -EFAULT.
> 
> Would you prefer that I include the reproducer directly in the patch
> submission rather than only linking to the gist?
Yes, please add it as 2nd commit and check git log on how to integrate it
into test_progs (tools/testing/selftests/bpf/) so it can run via CI.

Thanks,
Daniel