mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 16:53:20 -04:00
Code Issues Packages Projects Releases Wiki Activity

selftests/bpf: Exercise negative optlen in cgroup getsockopt hook

Browse Source 
Add a cgroup getsockopt selftest that sets ctx->optlen to -1. Use
TCP_ZEROCOPY_RECEIVE to exercise the kernel-buffer getsockopt hook.

The userspace-visible result is -EFAULT on both patched and unpatched
kernels, so the return value alone cannot distinguish the bug. The test
still exercises the kernel-buffer getsockopt path with a negative
ctx->optlen, which reproduces the hardened usercopy warning on unpatched
kernels.

Signed-off-by: Junseo Lim <zirajs7@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/4dbdcda23b2f2be06c5659f8102cd6bd036825b3.1786448307.git.zirajs7@gmail.com
This commit is contained in:
Junseo Lim
2026-08-11 23:19:08 +09:00
committed by Daniel Borkmann
parent 1b5aacd5b2
commit 6b0835ac79
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
tools/testing/selftests/bpf/prog_tests/sockopt.c
View File

@@ -1,4 +1,5 @@
// SPDX-License-Identifier: GPL-2.0
#include <linux/tcp.h>
#include <test_progs.h>
#include <io_uring/mini_liburing.h>
#include "cgroup_helpers.h"
@@ -283,6 +284,27 @@ static struct sockopt_test {
.error = EFAULT_GETSOCKOPT,
.io_uring_support = true,
},
{
.descr = "getsockopt: deny negative ctx->optlen in TCP_ZEROCOPY_RECEIVE",
.insns = {
/* ctx->optlen = -1 */
BPF_MOV64_IMM(BPF_REG_0, -1),
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
offsetof(struct bpf_sockopt, optlen)),
/* return 1 */
BPF_MOV64_IMM(BPF_REG_0, 1),
BPF_EXIT_INSN(),
},
.attach_type = BPF_CGROUP_GETSOCKOPT,
.expected_attach_type = BPF_CGROUP_GETSOCKOPT,
.get_level = IPPROTO_TCP,
.get_optname = TCP_ZEROCOPY_RECEIVE,
.get_optlen = sizeof(struct tcp_zerocopy_receive),
.error = EFAULT_GETSOCKOPT,
},
{
.descr = "getsockopt: ignore >PAGE_SIZE optlen",
.insns = {