[PATCH] bpf/btf: fix u32 subtraction overflow in btf_sec_info_cmp

[PATCH] bpf/btf: fix u32 subtraction overflow in btf_sec_info_cmp

[ibrahim zein]

The comparison function btf_sec_info_cmp() uses direct subtraction
of u32 values cast to int, which can produce incorrect results due
to integer overflow when values exceed 0x7FFFFFFF.

Replace with explicit comparisons to guarantee correct behavior
across all u32 value ranges.

Reported-by: Ibrahim Zein <zeroxjacks@gmail.com>
Signed-off-by: Ibrahim Zein <zeroxjacks@gmail.com>
---
 btf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/btf.c b/btf.c
index 4872d2a..5b3e1af 100644
--- a/btf.c
+++ b/btf.c
@@ -5548,7 +5548,11 @@ static int btf_sec_info_cmp(const void *a, const void *b)
 	const struct btf_sec_info *x = a;
 	const struct btf_sec_info *y = b;
 
-	return (int)(x->off - y->off) ? : (int)(x->len - y->len);
+	if (x->off != y->off)
+		return x->off < y->off ? -1 : 1;
+	if (x->len != y->len)
+		return x->len < y->len ? -1 : 1;
+	return 0;
 }
 
 static int btf_check_sec_info(struct btf_verifier_env *env,
-- 
2.51.0

Re: [PATCH] bpf/btf: fix u32 subtraction overflow in btf_sec_info_cmp

[Daniel Borkmann]

On 3/18/26 3:02 PM, ibrahim zein wrote:
> The comparison function btf_sec_info_cmp() uses direct subtraction
> of u32 values cast to int, which can produce incorrect results due
> to integer overflow when values exceed 0x7FFFFFFF.
> 
> Replace with explicit comparisons to guarantee correct behavior
> across all u32 value ranges.
> 
> Reported-by: Ibrahim Zein <zeroxjacks@gmail.com>
> Signed-off-by: Ibrahim Zein <zeroxjacks@gmail.com>

Ibrahim, you've been asked previously to only send patches with a related
BPF selftest which demonstrate/exercise the problematic behavior that is
being fixed. Recent example of a fix with accompanying BPF selftest:

   https://lore.kernel.org/all/20260304083228.142016-1-tangyazhou@zju.edu.cn/

Thanks,
Daniel

[PATCH] bpf/btf: fix u32 subtraction overflow in btf_sec_info_cmp

[Ibrahim Zein]

The comparison function btf_sec_info_cmp() uses direct subtraction
of u32 values cast to int, which can produce incorrect results due
to integer overflow when values exceed 0x7FFFFFFF.

Replace with explicit comparisons to guarantee correct behavior
across all u32 value ranges.

Reported-by: Ibrahim Zein <zeroxjacks@gmail.com>
Signed-off-by: Ibrahim Zein <zeroxjacks@gmail.com>
---
 kernel/bpf/btf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 4872d2a..5b3e1af 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -5548,7 +5548,11 @@ static int btf_sec_info_cmp(const void *a, const void *b)
 	const struct btf_sec_info *x = a;
 	const struct btf_sec_info *y = b;
 
-	return (int)(x->off - y->off) ? : (int)(x->len - y->len);
+	if (x->off != y->off)
+		return x->off < y->off ? -1 : 1;
+	if (x->len != y->len)
+		return x->len < y->len ? -1 : 1;
+	return 0;
 }
 
 static int btf_check_sec_info(struct btf_verifier_env *env,
-- 
2.51.0