From: Alexei Starovoitov Date: Fri, 5 Jun 2026 22:55:43 +0000 (-0700) Subject: Merge branch 'add-validation-for-bpf_set_retval-helper' X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=39a23eee83f694da1e35a33e12c1fd0930330fd6;p=thirdparty%2Flinux.git Merge branch 'add-validation-for-bpf_set_retval-helper' Xu Kuohai says: ==================== Add validation for bpf_set_retval helper From: Xu Kuohai The bpf_set_retval() helper is used by cgroup BPF programs to set the return value of the kernel hook. The argument type for this helper is ARG_ANYTHING. This allows setting a positive value, which no cgroup hook expects and can cause issues, such as the kernel panic reported in [1]. This series adds validation for the argument of the bpf_set_retval() helper. For BPF_LSM_CGROUP, the same validation as BPF_LSM_MAC is enforced, i.e. validate the argument against the LSM hook specific range, which is returned by bpf_lsm_get_retval_range(). For all other cgroup program types, restrict the argument to [-MAX_ERRNO, 0], which matches the kernel convention of 0 for success and negative errno for error. BPF_CGROUP_GETSOCKOPT is an exception from this restriction, since valid getsockopt implementations may return positive values (e.g. optlen), as allowed by commit c4dcfdd406aa ("bpf: Move getsockopt retval to struct bpf_cg_run_ctx"). [1] https://lore.kernel.org/all/567d3206-74a5-44e5-99c6-779c425f399e@std.uestc.edu.cn v5: - Use resolve_prog_type(env->prog) instead of env->prog->type for prog type checks - Target bpf-next tree v4: https://lore.kernel.org/bpf/20260604130458.617765-1-xukuohai@huaweicloud.com - Remove the return value limit for BPF_CGROUP_GETSOCKOPT type - Refine the range of return value of bpf_get_retval helper v3: https://lore.kernel.org/bpf/20260530101239.590395-1-xukuohai@huaweicloud.com/ - Mark R1 as precise to prevent validation bypass via branch pruning (sashiko) v2: https://lore.kernel.org/bpf/20260530055557.549474-1-xukuohai@huaweicloud.com/ - Extend validation from LSM cgroup BPF type to all cgroup BPF types (sashiko) v1: https://lore.kernel.org/bpf/20260523085806.417723-1-xukuohai@huaweicloud.com/ ==================== Link: https://patch.msgid.link/20260605140243.664590-1-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov --- 39a23eee83f694da1e35a33e12c1fd0930330fd6