From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0AD9A39021C for ; Mon, 6 Jul 2026 02:36:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783305420; cv=none; b=mo9hP75EDzub7VJqqLbAJU8XaG69MVf1rvAHyAGloRQujy67LOb942IKmIp1qm3LvJ9vGs5cBlQr+iTTrhv5f7/nWcvbwwQjgVaXGSocGS8JNUQgyIfPud9gEUdWDJVRECmj7uhE/d3czq958XypwC0fh32WRanl1wAC5zK0HmA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783305420; c=relaxed/simple; bh=cU02yNkwV1YzGPMRD4x++mPfJxsTNb9WTrGJT+hzgos=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ZgDRkhQu2O0/OtlrVWzxE25uYWEC0JUFEb59Yf0XRd2JX3hT21euR25ZKwMdeaijEDrEsvfWI6os/aCgPoS6/TcS2xpHlQTgmm6C3HPybhi9fV5RiHkiyMhy31+igkcTlf5ZJIMFix3smEfYbigbUSlM75F3hbIdjWZ/Ps3ljSs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=f68oQKu/; arc=none smtp.client-ip=209.85.215.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="f68oQKu/" Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-c9e7391839cso2325401a12.0 for ; Sun, 05 Jul 2026 19:36:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783305412; x=1783910212; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=BvHO/cnlokceDY89ApagHJNnWoYZbTLjHr/S4wwAwbI=; b=f68oQKu/hJmrRplostYehV8FJefd8k93zKjgaC/4RU7PHfBYhElCzZ8lLZeoWcgS6r rAPV/YgLUTQ7cz1PrdvM5sm3ROVvoMxpDoDqGmMwSeji5RZjfzQeLnMU0Phb+rVDGtgH 8Y0gEDVtpjq62F1DJf3tHPFEr3c62C1yBZVoRR6nkpMw5Ytz+p2plTCKUMPfGuFIXeVG j3G+LD0GcbzQVMT+wbpECqg8/1CO6CJ1rxqV2N6UjeOVg3sFbR83Z52FhyiQlK4M7GA2 VoSQ3vxeCtgOX+a9PcUK4OpOP+E9pIbB3ElFRzQwCckByKr9gsTtJOQchtMJOReyIJ74 0vQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783305412; x=1783910212; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=BvHO/cnlokceDY89ApagHJNnWoYZbTLjHr/S4wwAwbI=; b=nI2+W2CQFb/7bpZGVwhQ+QMC4XeELc5bdAigo1/QQtxFaon8xQJIgso3XgF2g4uUKG ffQdof97fajFZSityQ97wNDFfNpUhxLClh+K2fpz/W0v/ua2qKP0enX5zBAhH7MgW8QK WRG9WK78JGwgdSIXYfqvo8TbvYtG2lmpUuobLFhGxTVzMQ/k5tUPExp+1V/Yj4Y6GGaU ch2aqii0rbmYI/8BEfb7uxpwrB3iTQi9EHp9AXfM14M9VhFq5UMleNYdxoRD2B4Gm3CV m8lrNNYcOrOQOxuEQvfojPb06SGj7gpPGUg5oz+Yp/q0eN/n7CTTTndFatPv4A315ORI 5eiQ== X-Forwarded-Encrypted: i=1; AHgh+RoMWn5FmnNBlR+Gw6NlpAY0UE4qY/3v6VGEyfvDcSB04OmLNaPbrAbgiXiXVUWAmsFRd59qRPdPde3bVbk=@vger.kernel.org X-Gm-Message-State: AOJu0Yx4AyBV7J+lDZW2ArwOpKutTAcDFjSAwb8NiIvRZr7Tg/Mp7pJO mEasgTdow/ebzMsxNxHBi7tUG8MpIo6zg3KBFp7fwlMenZ0JMD0oK44X X-Gm-Gg: AfdE7cnWE7sqfBTMnCcDpvErIxI0uiYqEeXVy/JJLSXDJKSoPXaucp1jk0knvV/JFCU 1tVlwqCjhUs2lIAWmbXlH96zI9Jp4DWwbKbCV1FSq5TEWexxJH3e9RNj1gVy7BWynohcFN1rXjI dngng7wC/NBMSJmsOWWccmvfGsSr5akhY2Fb1o+bq6krZj8Kg8SwvtbTPHt5O57rjTDZnORYc5j +4IF2qox1i+ON4SVzUm+IxJQ2vQ30xE62UutZLIOGqWh+IO1kxHWIZEgYd3QUXalXAC3RtAF5XJ bBElGWZDDu9jncylg9O6QPeMl7aQAa3sJminQ6mVH8vF4dfyd0kOJr37xTIy3Udp7xtVDNpCQbh wp+nUtK5nBi87A/7ZNnWOSb+FQPBdXOo+ZeYgq1Mno+n5dV1gvMzyq492jfWlWY3DAiN+WaD8mn A0+Pu3xyNcaw== X-Received: by 2002:a05:6a20:7350:b0:3bf:d354:134f with SMTP id adf61e73a8af0-3c03e4c1caamr9090776637.44.1783305410197; Sun, 05 Jul 2026 19:36:50 -0700 (PDT) Received: from lgs.. ([101.76.249.46]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c9e920d7ffasm5125558a12.22.2026.07.05.19.36.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 05 Jul 2026 19:36:49 -0700 (PDT) From: Guangshuo Li To: Andrii Nakryiko , Eduard Zingerman , Alexei Starovoitov , Daniel Borkmann , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Varun R Mallya , bpf@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li Subject: [PATCH v2] libbpf: Limit bitfield dump reads to checked bytes Date: Mon, 6 Jul 2026 10:36:32 +0800 Message-ID: <20260706023632.625353-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit btf_dump_get_bitfield_value() bounds-checks the number of bytes covered by the bitfield, but the value-building loops read the full backing type size. For narrow bitfields this can read past the checked range. Checking the full backing type size is too strict for packed bitfields. For example, a packed structure can contain an 8-bit field backed by an int type whose BTF size is 4, while the actual object bytes covering the field are only 1 byte. Keep the bounds check based on the bytes covered by the field, and make the value-building loops consume the same checked byte range. Preserve the full-size read for the non-bitfield path used by unaligned enum values. Fixes: 5714ca8cba5e ("libbpf: Fix OOB read in btf_dump_get_bitfield_value") Signed-off-by: Guangshuo Li --- v2: - Do not check the full backing type size, as it rejects valid packed bitfields. - Limit the value-building loops to the checked byte range instead. - Preserve the non-bitfield path used for unaligned enum values. tools/lib/bpf/btf_dump.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c index cc1ba65bb6c5..5d185f7961ff 100644 --- a/tools/lib/bpf/btf_dump.c +++ b/tools/lib/bpf/btf_dump.c @@ -1766,17 +1766,21 @@ static int btf_dump_get_bitfield_value(struct btf_dump *d, __u64 num = 0; int i; - /* Calculate how many bytes cover the bitfield */ - start_bit = bits_offset % 8; - nr_bytes = (start_bit + bit_sz + 7) / 8; + if (bit_sz) { + /* Calculate how many bytes cover the bitfield */ + start_bit = bits_offset % 8; + nr_bytes = (start_bit + bit_sz + 7) / 8; + } else { + nr_bytes = t->size; + } /* Bound check */ if (data + nr_bytes > d->typed_dump->data_end) return -E2BIG; /* Maximum supported bitfield size is 64 bits */ - if (t->size > 8) { - pr_warn("unexpected bitfield size %d\n", t->size); + if (nr_bytes < 1 || nr_bytes > 8) { + pr_warn("unexpected bitfield size %d\n", nr_bytes); return -EINVAL; } @@ -1784,13 +1788,13 @@ static int btf_dump_get_bitfield_value(struct btf_dump *d, * stored in num, then we left/right shift num to eliminate irrelevant bits. */ #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ - for (i = t->size - 1; i >= 0; i--) + for (i = nr_bytes - 1; i >= 0; i--) num = num * 256 + bytes[i]; - nr_copy_bits = bit_sz + bits_offset; + nr_copy_bits = bit_sz ? bit_sz + bits_offset : nr_bytes * 8; #elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ - for (i = 0; i < t->size; i++) + for (i = 0; i < nr_bytes; i++) num = num * 256 + bytes[i]; - nr_copy_bits = t->size * 8 - bits_offset; + nr_copy_bits = nr_bytes * 8 - bits_offset; #else # error "Unrecognized __BYTE_ORDER__" #endif -- 2.43.0