From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4EC7F449990 for ; Tue, 11 Aug 2026 14:19:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786457956; cv=none; b=lLpsn1wH/jF+3neZNL9Azu+BJB/TXvkZGrd5P/mIIy2csWDmFcVBsVzpWp0UZCM85MQH+iJNFG0yCLzz9iWA0H04l110pXRj1L+R8U3LTuZFeiMwrcnIC5F/vpI5BR9XD80/63OufFAr3r1+qRJNcQv2Au+BpaVKZrrMwv0CIKg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786457956; c=relaxed/simple; bh=UK8Gbb4rglh4FaymSjNbOeD1SzoLlYvu+K2etj4vcb0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fcNAggTHSPWWJTkCfEehLWMjmnu3gQYp/E0pahM6stzeXCnne9LcSTVqhSJCpf0+ZzZppgeE0OMhcCbrDexzFA+aBiSHG+yLuTOxn41CMu+w9p74jmXULjtUmhPJ9QXyZx1awhbMjqAToFwGEVDTj/50bJrw47nf0nGspMzTOxA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=nn65hAzb; arc=none smtp.client-ip=209.85.216.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="nn65hAzb" Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-38fdeaed181so4103428a91.1 for ; Tue, 11 Aug 2026 07:19:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786457955; x=1787062755; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=6kMGAmgL2sHoPiISlJphA2bmnreOOIlXDYBkioBYhB4=; b=nn65hAzbLxWYPtNwXX2BiaPUgFiu8SX9Pg69szjvldzSjKOkJX6eRIXyvR65Lqif6v Gj/x4VNfMBkZCCsUjHaixahrUqOe2w3IoMda5/pJqRsvtzrInmC41KWbju8dJXZ2SfGF umeExrfruLZvz580OXIfDHtGVyvbUeo2d6JBWn4t1TxvHV4NanA3UniYxwPKz31wBozr 9y2RXN87VjGOmtMo9DxetDTHKobMSeQqAWLLxh3ljs3gohmboTbarHmbzMcsl82ylHxb HuGOLzJo26MZk1zrCdW/vqRLk6ti4OVF0HuiK4sNBdtout63nS2IR1ZTEHbnmbn1UiRz PK8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786457955; x=1787062755; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=6kMGAmgL2sHoPiISlJphA2bmnreOOIlXDYBkioBYhB4=; b=ATLryL/zuN/YboVqVEYL45I0gB027XnhlNR1lsIYyVaaOzHjkmMYhFFG0/+EVPo6PO thmiIFs7p2/SZBD9dxyTx0CqhYaxyjzqUf1EihTmn/6ss/bRz9SRPwnLD5HzcdkWmn1U Ln9IUEoaW1PFvAxibsNytkTUgvbYr8aUaXAxeczLzo6gF3BzVMV1Oze+tm0ofuGFH/hE zqhCfa/Vai6tVg+MIupNAov2tTmMHJdKX022qZj+OcjIV6BCE7CsMxzh7baJtUP76ub2 bH9W9r7i5bPHSgT8nd5+BrvroiRtG1DCqBew015HhHL9d1Uvj/w19xlrMiC0uXcl93d6 o1Ow== X-Forwarded-Encrypted: i=1; AHgh+Ro4KLSwrIf1oBHH/+aSbrg6++y+K+PyOpieUMBoLyiYsY6W9CrPYLm03w8JCN86LxoRmVa54ax2hICyEE8=@vger.kernel.org X-Gm-Message-State: AOJu0YzAMUf2zTh1CXEqVbabYlZAYVoELUKy9RPRWUf8jwHMwjr9lBBj DUAADh9y0Oue/bRB/s4+fHGbEuq44/1B8K88jmSexpKoBGEHxZsEnalb X-Gm-Gg: AR+sD12lcsVjAh46668Mpx+W6yQRan5AwII8CgoOUbBzgEoqY7CRFcPctDQnx1naVaz s26S0Z/z+QkFRj/d6GrmFbCK9XwcLtiRJqv4weRnc0NLOExHqnL+Nw/hABHZqv5MLRWWZoFDyHm J/nDAdiX6B/QSBiYA6uIsDBFia+ELgV+jO63PKEs9UIkq3hk7suJCgHTIK5Rji12EpJTdWsW6ce GQw+04DgqQjrF8oDlnGwlAKExOgzY1nQoiUOjEukiwkSKLZm+DZjf8ffaAT+zs5yMyXiCXboceJ /QBZwHNtT55b31cM03tysZsy4m4NR51V2M1h206Dze91zPlCmeJyYGIuViospMbNmGyFQA2B6KT bmMbVYl9m7VotwF+zuZGyIPe4y0gcRkam0uuU3e05Dw9vsbAGevZ50eQtPkGTjSD48F3LFn3GSh ftSmEseR/q9pg6oyMo4KZekmyK+0qbPKret/+o4WKCfS/9xCZ2SNyYIv4= X-Received: by 2002:a17:90b:4d8f:b0:37f:e1af:df22 with SMTP id 98e67ed59e1d1-392ec5a78b8mr3597233a91.17.1786457954421; Tue, 11 Aug 2026 07:19:14 -0700 (PDT) Received: from omen-arch ([211.58.239.197]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-392d534bfc9sm4028489a91.10.2026.08.11.07.19.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Aug 2026 07:19:13 -0700 (PDT) From: Junseo Lim To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau Cc: Stanislav Fomichev , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, Sechang Lim Subject: [PATCH bpf v2 0/2] bpf: Reject negative optlen in cgroup getsockopt hook Date: Tue, 11 Aug 2026 23:19:06 +0900 Message-ID: X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit A cgroup getsockopt BPF program can set a negative optlen after the kernel getsockopt handler has run. For TCP_ZEROCOPY_RECEIVE, the kernel-buffer hook did not validate the lower bound and the negative value could reach copy_to_sockptr() as a size_t. Patch 1 rejects negative optlen values in the kernel-buffer hook. Patch 2 adds a test_progs selftest that reproduces the issue through TCP_ZEROCOPY_RECEIVE. For patch 2, the userspace-visible errno is EFAULT on both fixed and unfixed kernels, so the broken behavior cannot be detected from the getsockopt() return value alone. The selftest exercises the problematic path and can be used to reproduce the hardened usercopy warning on unpatched kernels. Changelog: v1 -> v2: - Add the selftest for negative optlen. - Add Emil's Reviewed-by tag. - Add Reported-by tag. v1: https://lore.kernel.org/bpf/20260726070122.2407344-1-zirajs7@gmail.com/T/ Junseo Lim (2): bpf: Reject negative optlen in cgroup getsockopt hook selftests/bpf: Exercise negative optlen in cgroup getsockopt hook kernel/bpf/cgroup.c | 2 +- .../selftests/bpf/prog_tests/sockopt.c | 22 +++++++++++++++++++ 2 files changed, 23 insertions(+), 1 deletion(-) -- 2.55.0