[PATCH] potential negative index dereference fix in get_exec_path()

[PATCH] potential negative index dereference fix in get_exec_path()

[Ruslan Semchenko]

If readlink() fails, len will be -1, which can cause negative indexing
and undefined behavior. This patch ensures that len is set to 0 on
readlink failure, preventing such issues.

Signed-off-by: Ruslan Semchenko <uncleruc2075@gmail.com>
---
 tools/bpf/bpf_jit_disasm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/bpf/bpf_jit_disasm.c b/tools/bpf/bpf_jit_disasm.c
index 1baee9e2aba9..5ab8f80e2834 100644
--- a/tools/bpf/bpf_jit_disasm.c
+++ b/tools/bpf/bpf_jit_disasm.c
@@ -45,6 +45,8 @@ static void get_exec_path(char *tpath, size_t size)
 	assert(path);
 
 	len = readlink(path, tpath, size);
+	if (len < 0)
+		len = 0;
 	tpath[len] = 0;
 
 	free(path);
-- 
2.49.0

Re: [PATCH] potential negative index dereference fix in get_exec_path()

[Daniel Borkmann]

On 6/12/25 3:18 PM, Ruslan Semchenko wrote:
> If readlink() fails, len will be -1, which can cause negative indexing
> and undefined behavior. This patch ensures that len is set to 0 on
> readlink failure, preventing such issues.
> 
> Signed-off-by: Ruslan Semchenko <uncleruc2075@gmail.com>

Looks reasonable, thanks! When applying patch $subj can be tweaked into:

   "tools/bpf_jit_disasm: Fix potential negative tpath index in get_exec_path()"

(bpf-next tree is fine)

Acked-by: Daniel Borkmann <daniel@iogearbox.net>

> ---
>   tools/bpf/bpf_jit_disasm.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/tools/bpf/bpf_jit_disasm.c b/tools/bpf/bpf_jit_disasm.c
> index 1baee9e2aba9..5ab8f80e2834 100644
> --- a/tools/bpf/bpf_jit_disasm.c
> +++ b/tools/bpf/bpf_jit_disasm.c
> @@ -45,6 +45,8 @@ static void get_exec_path(char *tpath, size_t size)
>   	assert(path);
>   
>   	len = readlink(path, tpath, size);
> +	if (len < 0)
> +		len = 0;
>   	tpath[len] = 0;
>   
>   	free(path);

Re: [PATCH] potential negative index dereference fix in get_exec_path()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Thu, 12 Jun 2025 16:18:16 +0300 you wrote:
> If readlink() fails, len will be -1, which can cause negative indexing
> and undefined behavior. This patch ensures that len is set to 0 on
> readlink failure, preventing such issues.
> 
> Signed-off-by: Ruslan Semchenko <uncleruc2075@gmail.com>
> ---
>  tools/bpf/bpf_jit_disasm.c | 2 ++
>  1 file changed, 2 insertions(+)

Here is the summary with links:
  - potential negative index dereference fix in get_exec_path()
    https://git.kernel.org/bpf/bpf-next/c/af91af33c168

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html