Re: [PATCH v3 bpf-next 09/11] bpftool: Add ability to dump LOC_PARAM, LOC_PROTO and LOCSEC

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] bpftool: truncation of 24-bit BTF vlen to 16-bit in BTF_KIND_LOC_PROTO
--

commit 2e08d4509f6018d2621350930f039568aa3418e3
Author: Alan Maguire <alan.maguire@oracle.com>

bpftool: Add ability to dump LOC_PARAM, LOC_PROTO and LOCSEC

This commit adds support to bpftool for dumping new BTF kinds (LOC_PARAM,
LOC_PROTO, and LOCSEC) in both normal and JSON formats. It provides string
rendering for LOC_PARAM parameters, associated values for LOC_PROTOs, and
function names for LOCSEC sites.

> diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c
> index bbe8f9ea144fa..5e0cb58628117 100644
> --- a/tools/bpf/bpftool/btf.c
> +++ b/tools/bpf/bpftool/btf.c
[ ... ]
> @@ -415,6 +495,95 @@ static int dump_btf_type(const struct btf *btf, __u32 id,
[ ... ]
> +	case BTF_KIND_LOC_PROTO: {
> +		__u32 *params = btf_loc_proto_params(t);
> +		__u16 vlen = btf_vlen(t);

[Severity: Low]
Does this code unintentionally truncate the 24-bit variable length count
returned by btf_vlen() into a 16-bit unsigned integer?

While a function's parameter count is unlikely to exceed 65535 in practice,
a maliciously crafted BTF file could potentially trigger this truncation
when parsing a BTF_KIND_LOC_PROTO entry. Other BTF kinds like
BTF_KIND_LOC_PARAM in this patch appear to use __u32 for vlen.

> +		int i;
> +
> +		if (json_output) {
> +			jsonw_uint_field(w, "vlen", vlen);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916074118.1007116-1-alan.maguire@oracle.com?part=9