Re: [PATCH bpf-next] bpf: Fix stream capacity leak and spurious -ENOSPC in bpf_stream_stage_commit

["Kumar Kartikeya Dwivedi" <memxor@gmail.com>]

On Tue Aug 25, 2026 at 1:39 PM CEST, Khawar Ahemad wrote:
> bpf_stream_stage_commit() accounts the staged string length against
> the stream capacity via bpf_stream_consume_capacity() before
> detaching the queued elements with llist_del_all().
>
> If no elements are returned by llist_del_all() (for instance, when
> the staging list was empty or failed to allocate elements), the
> function returns early without releasing the consumed capacity.
> Because no elements are queued into stream->log, no reader will ever
> pop or release this capacity, leading to a permanent capacity leak.
>
> Furthermore, if ss->len is 0, bpf_stream_consume_capacity() is invoked
> needlessly and fails with -ENOSPC if the stream is currently at
> capacity, spuriously rejecting a zero-byte commit.
>
> Fix both issues by:
> 1. Returning early if ss->len is 0.
> 2. Rolling back the consumed capacity with bpf_stream_release_capacity()
>    if llist_del_all() returns NULL.
>
> Fixes: 5ab154f1463a ("bpf: Introduce BPF standard streams")
> Signed-off-by: Khawar Ahemad <ahemadkhawar123@gmail.com>
> ---

Completely unnecessary.

pw-bot: cr

>  kernel/bpf/stream.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/kernel/bpf/stream.c b/kernel/bpf/stream.c
> index 7a5c3ac867..3ad58c8284 100644
> --- a/kernel/bpf/stream.c
> +++ b/kernel/bpf/stream.c
> @@ -350,15 +350,21 @@ int bpf_stream_stage_commit(struct bpf_stream_stage *ss, struct bpf_prog *prog,
>  	if (!stream)
>  		return -EINVAL;
>
> +	if (!ss->len)
> +		return 0;
> +
>  	ret = bpf_stream_consume_capacity(stream, ss->len);
>  	if (ret)
>  		return ret;
>
>  	list = llist_del_all(&ss->log);
> -	head = tail = list;
> -
> -	if (!list)
> +	if (!list) {
> +		bpf_stream_release_capacity(stream, ss->len);
>  		return 0;
> +	}
> +
> +	head = list;
> +	tail = list;
>  	while (llist_next(list)) {
>  		tail = llist_next(list);
>  		list = tail;