[PATCH bpf-next] bpf: Fix stream capacity leak and spurious -ENOSPC in bpf_stream_stage_commit

[PATCH bpf-next] bpf: Fix stream capacity leak and spurious -ENOSPC in bpf_stream_stage_commit

[Khawar Ahemad]

bpf_stream_stage_commit() accounts the staged string length against
the stream capacity via bpf_stream_consume_capacity() before
detaching the queued elements with llist_del_all().

If no elements are returned by llist_del_all() (for instance, when
the staging list was empty or failed to allocate elements), the
function returns early without releasing the consumed capacity.
Because no elements are queued into stream->log, no reader will ever
pop or release this capacity, leading to a permanent capacity leak.

Furthermore, if ss->len is 0, bpf_stream_consume_capacity() is invoked
needlessly and fails with -ENOSPC if the stream is currently at
capacity, spuriously rejecting a zero-byte commit.

Fix both issues by:
1. Returning early if ss->len is 0.
2. Rolling back the consumed capacity with bpf_stream_release_capacity()
   if llist_del_all() returns NULL.

Fixes: 5ab154f1463a ("bpf: Introduce BPF standard streams")
Signed-off-by: Khawar Ahemad <ahemadkhawar123@gmail.com>
---
 kernel/bpf/stream.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/kernel/bpf/stream.c b/kernel/bpf/stream.c
index 7a5c3ac867..3ad58c8284 100644
--- a/kernel/bpf/stream.c
+++ b/kernel/bpf/stream.c
@@ -350,15 +350,21 @@ int bpf_stream_stage_commit(struct bpf_stream_stage *ss, struct bpf_prog *prog,
 	if (!stream)
 		return -EINVAL;
 
+	if (!ss->len)
+		return 0;
+
 	ret = bpf_stream_consume_capacity(stream, ss->len);
 	if (ret)
 		return ret;
 
 	list = llist_del_all(&ss->log);
-	head = tail = list;
-
-	if (!list)
+	if (!list) {
+		bpf_stream_release_capacity(stream, ss->len);
 		return 0;
+	}
+
+	head = list;
+	tail = list;
 	while (llist_next(list)) {
 		tail = llist_next(list);
 		list = tail;
-- 
2.54.0 (Apple Git-157)

Re: [PATCH bpf-next] bpf: Fix stream capacity leak and spurious -ENOSPC in bpf_stream_stage_commit

[Khawar Ahemad]

Hi Sashiko reviewer,

Thanks for the thoughtful analysis. Addressing both points:

1. Regarding 0-byte elements (Low):
A 0-byte element in BPF streams carries no payload and no delimiter
(unlike NUL-terminated strings in userspace, streams are raw byte logs).
When bpf_stream_read() encounters a 0-byte element, min(0, rem_len) is 0,
copy_to_user() copies 0 bytes, and the element is immediately popped and
freed. Staging and committing a purely 0-byte stage transfers zero bytes
of data to readers; returning early when ss->len == 0 safely avoids
unnecessary atomic operations and lock contention on stream->log.

2. Regarding the rollback path and commit description (Medium):
In normal sequential execution, ss->len > 0 implies ss->log is non-empty
because ss->len is only incremented upon successful element enqueue.
The if (!list) rollback check is defensive programming: in the unpatched
code, if list was NULL, the function returned 0 without considering any
capacity consumed. Adding bpf_stream_release_capacity() ensures that even
under abnormal or future decoupled states, capacity accounting remains
strictly symmetric with queue state.

The primary immediate functional fix is preventing spurious -ENOSPC:
when stream->capacity is at BPF_STREAM_MAX_CAPACITY, calling
bpf_stream_consume_capacity(stream, 0) returned -ENOSPC due to the
atomic_read(&stream->capacity) >= BPF_STREAM_MAX_CAPACITY check,
incorrectly failing zero-byte stage commits.

Thanks,
Khawar Ahemad <ahemadkhawar123@gmail.com>

Re: [PATCH bpf-next] bpf: Fix stream capacity leak and spurious -ENOSPC in bpf_stream_stage_commit

[Kumar Kartikeya Dwivedi]

On Tue Aug 25, 2026 at 1:39 PM CEST, Khawar Ahemad wrote:
> bpf_stream_stage_commit() accounts the staged string length against
> the stream capacity via bpf_stream_consume_capacity() before
> detaching the queued elements with llist_del_all().
>
> If no elements are returned by llist_del_all() (for instance, when
> the staging list was empty or failed to allocate elements), the
> function returns early without releasing the consumed capacity.
> Because no elements are queued into stream->log, no reader will ever
> pop or release this capacity, leading to a permanent capacity leak.
>
> Furthermore, if ss->len is 0, bpf_stream_consume_capacity() is invoked
> needlessly and fails with -ENOSPC if the stream is currently at
> capacity, spuriously rejecting a zero-byte commit.
>
> Fix both issues by:
> 1. Returning early if ss->len is 0.
> 2. Rolling back the consumed capacity with bpf_stream_release_capacity()
>    if llist_del_all() returns NULL.
>
> Fixes: 5ab154f1463a ("bpf: Introduce BPF standard streams")
> Signed-off-by: Khawar Ahemad <ahemadkhawar123@gmail.com>
> ---

Completely unnecessary.

pw-bot: cr

>  kernel/bpf/stream.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/kernel/bpf/stream.c b/kernel/bpf/stream.c
> index 7a5c3ac867..3ad58c8284 100644
> --- a/kernel/bpf/stream.c
> +++ b/kernel/bpf/stream.c
> @@ -350,15 +350,21 @@ int bpf_stream_stage_commit(struct bpf_stream_stage *ss, struct bpf_prog *prog,
>  	if (!stream)
>  		return -EINVAL;
>
> +	if (!ss->len)
> +		return 0;
> +
>  	ret = bpf_stream_consume_capacity(stream, ss->len);
>  	if (ret)
>  		return ret;
>
>  	list = llist_del_all(&ss->log);
> -	head = tail = list;
> -
> -	if (!list)
> +	if (!list) {
> +		bpf_stream_release_capacity(stream, ss->len);
>  		return 0;
> +	}
> +
> +	head = list;
> +	tail = list;
>  	while (llist_next(list)) {
>  		tail = llist_next(list);
>  		list = tail;