[PATCH bpf-next v1 1/2] bpf: Reject oversized stream read buffers

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

BPF_PROG_STREAM_READ_BY_FD exposes stream_buf_len as a u32, but the
internal stream reader accepts an int. Values above INT_MAX therefore
become negative before bpf_stream_read(), producing negative consumption
lengths. The generic usercopy size check prevents the oversized copy, but
emits a warning and reports EFAULT for an unchecked argument.

Change bpf_prog_stream_read() to accept u32 and reject values that the
signed reader cannot represent.

Fixes: 5ab154f1463a ("bpf: Introduce BPF standard streams")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 include/linux/bpf.h | 2 +-
 kernel/bpf/stream.c | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index ffa5626411ac..717436698ec3 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -4101,7 +4101,7 @@ void bpf_put_buffers(void);
 
 void bpf_prog_stream_init(struct bpf_prog *prog);
 void bpf_prog_stream_free(struct bpf_prog *prog);
-int bpf_prog_stream_read(struct bpf_prog *prog, enum bpf_stream_id stream_id, void __user *buf, int len);
+int bpf_prog_stream_read(struct bpf_prog *prog, enum bpf_stream_id stream_id, void __user *buf, u32 len);
 void bpf_stream_stage_init(struct bpf_stream_stage *ss);
 void bpf_stream_stage_free(struct bpf_stream_stage *ss);
 __printf(2, 3)
diff --git a/kernel/bpf/stream.c b/kernel/bpf/stream.c
index 7a5c3ac8676b..2b80a0599865 100644
--- a/kernel/bpf/stream.c
+++ b/kernel/bpf/stream.c
@@ -203,13 +203,15 @@ static int bpf_stream_read(struct bpf_stream *stream, void __user *buf, int len)
 	return ret ? ret : len - rem_len;
 }
 
-int bpf_prog_stream_read(struct bpf_prog *prog, enum bpf_stream_id stream_id, void __user *buf, int len)
+int bpf_prog_stream_read(struct bpf_prog *prog, enum bpf_stream_id stream_id, void __user *buf, u32 len)
 {
 	struct bpf_stream *stream;
 
 	stream = bpf_stream_get(stream_id, prog->aux);
 	if (!stream)
 		return -ENOENT;
+	if (len > INT_MAX)
+		return -EINVAL;
 	return bpf_stream_read(stream, buf, len);
 }
 
-- 
2.53.0