[PATCH bpf] bpf: Reject negative optlen in cgroup getsockopt hook

[PATCH bpf] bpf: Reject negative optlen in cgroup getsockopt hook

[Junseo Lim]

A cgroup getsockopt BPF program can shrink ctx->optlen after the
kernel getsockopt handler has run. The kernel-buffer variant, used by
TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original
length.

If BPF writes a negative optlen, that value is accepted and propagated
back to the TCP getsockopt code. It can then be passed to
copy_to_sockptr() as a size_t and trigger the hardened usercopy
bytes > INT_MAX warning.

Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(),
matching the lower-bound validation already present in the sockptr-based
getsockopt hook.

Fixes: 9cacf81f8161 ("bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE")
Signed-off-by: Junseo Lim <zirajs7@gmail.com>
---
Reproducer and warning: 
https://gist.github.com/ZirAjs/a177ec6d8f2c8ed7d93edca6313a9255

Tested by building and booting the patched kernel. The reproducer 
returns -EFAULT and no longer triggers the hardened usercopy warning.

 kernel/bpf/cgroup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 4355ccb78a9c..c04a244fe2e6 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -2235,7 +2235,7 @@ int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level,
 	if (ret < 0)
 		return ret;
 
-	if (ctx.optlen > *optlen)
+	if (ctx.optlen > *optlen || ctx.optlen < 0)
 		return -EFAULT;
 
 	/* BPF programs can shrink the buffer, export the modifications.
-- 
2.55.0

Re: [PATCH bpf] bpf: Reject negative optlen in cgroup getsockopt hook

[Emil Tsalapatis]

On Sun Jul 26, 2026 at 3:01 AM EDT, Junseo Lim wrote:
> A cgroup getsockopt BPF program can shrink ctx->optlen after the
> kernel getsockopt handler has run. The kernel-buffer variant, used by
> TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original
> length.
>
> If BPF writes a negative optlen, that value is accepted and propagated
> back to the TCP getsockopt code. It can then be passed to
> copy_to_sockptr() as a size_t and trigger the hardened usercopy
> bytes > INT_MAX warning.
>
> Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(),
> matching the lower-bound validation already present in the sockptr-based
> getsockopt hook.
>
> Fixes: 9cacf81f8161 ("bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE")
> Signed-off-by: Junseo Lim <zirajs7@gmail.com>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

It'd be worth resending with a reproducer setting optlen to negative.

> ---
> Reproducer and warning: 
> https://gist.github.com/ZirAjs/a177ec6d8f2c8ed7d93edca6313a9255
>
> Tested by building and booting the patched kernel. The reproducer 
> returns -EFAULT and no longer triggers the hardened usercopy warning.
>
>  kernel/bpf/cgroup.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
> index 4355ccb78a9c..c04a244fe2e6 100644
> --- a/kernel/bpf/cgroup.c
> +++ b/kernel/bpf/cgroup.c
> @@ -2235,7 +2235,7 @@ int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level,
>  	if (ret < 0)
>  		return ret;
>  
> -	if (ctx.optlen > *optlen)
> +	if (ctx.optlen > *optlen || ctx.optlen < 0)
>  		return -EFAULT;
>  
>  	/* BPF programs can shrink the buffer, export the modifications.