Re: [PATCH bpf-next v2 1/4] bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen

[Martin KaFai Lau <martin.lau@xxxxxxxxx>]

On 4/27/23 1:04 PM, Stanislav Fomichev wrote:
> @@ -1881,8 +1886,10 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
>   		.optname = optname,
>   		.current_task = current,
>   	};
> +	int orig_optlen;
>   	int ret;
>   
> +	orig_optlen = max_optlen;

For getsockopt, when the kernel's getsockopt finished successfully (the 
following 'if (!retval)' case), how about also setting orig_optlen to the kernel 
returned 'optlen'. For example, the user's orig_optlen is 8096 and the kernel 
returned optlen is 1024. If the bpf prog still sets the ctx.optlen to something 
> PAGE_SIZE, -EFAULT will be returned.

>   	ctx.optlen = max_optlen;
>   	max_optlen = sockopt_alloc_buf(&ctx, max_optlen, &buf);
>   	if (max_optlen < 0)
> @@ -1922,6 +1929,11 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
>   		goto out;
>   
>   	if (optval && (ctx.optlen > max_optlen || ctx.optlen < 0)) {
> +		if (orig_optlen > PAGE_SIZE && ctx.optlen >= 0) {
> +			pr_info_once("bpf getsockopt: ignoring program buffer with optlen=%d (max_optlen=%d)\n",
> +				     ctx.optlen, max_optlen);
> +			goto out;
> +		}
>   		ret = -EFAULT;
>   		goto out;
>   	}