[PATCH bpf-next 1/2] libbpf: fix potential overflow in ring__consume_n()

[PATCH bpf-next 1/2] libbpf: fix potential overflow in ring__consume_n()

[Andrii Nakryiko]

ringbuf_process_ring() return int64_t, while ring__consume_n() assigns
it to int. It's highly unlikely, but possible for ringbuf_process_ring()
to return value larger than INT_MAX, so use int64_t. ring__consume_n()
does check INT_MAX before returning int result to the user.

Fixes: 4d22ea94ea33 ("libbpf: Add ring__consume_n / ring_buffer__consume_n")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
 tools/lib/bpf/ringbuf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/lib/bpf/ringbuf.c b/tools/lib/bpf/ringbuf.c
index 99e44cf02321..37c5a2d86a78 100644
--- a/tools/lib/bpf/ringbuf.c
+++ b/tools/lib/bpf/ringbuf.c
@@ -405,7 +405,7 @@ int ring__map_fd(const struct ring *r)
 
 int ring__consume_n(struct ring *r, size_t n)
 {
-	int res;
+	int64_t res;
 
 	res = ringbuf_process_ring(r, n);
 	if (res < 0)
-- 
2.43.0

[PATCH bpf-next 2/2] libbpf: fix ring_buffer__consume_n() return result logic

[Andrii Nakryiko]

Add INT_MAX check to ring_buffer__consume_n(). We do the similar check
to handle int return result of all these ring buffer APIs in other APIs
and ring_buffer__consume_n() is missing one. This patch fixes this
omission.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
 tools/lib/bpf/ringbuf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/lib/bpf/ringbuf.c b/tools/lib/bpf/ringbuf.c
index 37c5a2d86a78..bfd8dac4c0cc 100644
--- a/tools/lib/bpf/ringbuf.c
+++ b/tools/lib/bpf/ringbuf.c
@@ -301,7 +301,7 @@ int ring_buffer__consume_n(struct ring_buffer *rb, size_t n)
 		if (n == 0)
 			break;
 	}
-	return res;
+	return res > INT_MAX ? INT_MAX : res;
 }
 
 /* Consume available ring buffer(s) data without event polling.
-- 
2.43.0

Re: [PATCH bpf-next 2/2] libbpf: fix ring_buffer__consume_n() return result logic

[Kumar Kartikeya Dwivedi]

On Tue, 30 Apr 2024 at 22:31, Andrii Nakryiko <andrii@kernel.org> wrote:
>
> Add INT_MAX check to ring_buffer__consume_n(). We do the similar check
> to handle int return result of all these ring buffer APIs in other APIs
> and ring_buffer__consume_n() is missing one. This patch fixes this
> omission.
>
> Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
> ---

Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

Re: [PATCH bpf-next 1/2] libbpf: fix potential overflow in ring__consume_n()

[Kumar Kartikeya Dwivedi]

On Tue, 30 Apr 2024 at 22:24, Andrii Nakryiko <andrii@kernel.org> wrote:
>
> ringbuf_process_ring() return int64_t, while ring__consume_n() assigns
> it to int. It's highly unlikely, but possible for ringbuf_process_ring()
> to return value larger than INT_MAX, so use int64_t. ring__consume_n()
> does check INT_MAX before returning int result to the user.
>
> Fixes: 4d22ea94ea33 ("libbpf: Add ring__consume_n / ring_buffer__consume_n")
> Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
> ---

Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

Re: [PATCH bpf-next 1/2] libbpf: fix potential overflow in ring__consume_n()

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Martin KaFai Lau <martin.lau@kernel.org>:

On Tue, 30 Apr 2024 13:19:51 -0700 you wrote:
> ringbuf_process_ring() return int64_t, while ring__consume_n() assigns
> it to int. It's highly unlikely, but possible for ringbuf_process_ring()
> to return value larger than INT_MAX, so use int64_t. ring__consume_n()
> does check INT_MAX before returning int result to the user.
> 
> Fixes: 4d22ea94ea33 ("libbpf: Add ring__consume_n / ring_buffer__consume_n")
> Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
> 
> [...]

Here is the summary with links:
  - [bpf-next,1/2] libbpf: fix potential overflow in ring__consume_n()
    https://git.kernel.org/bpf/bpf-next/c/00f0e08f23fc
  - [bpf-next,2/2] libbpf: fix ring_buffer__consume_n() return result logic
    https://git.kernel.org/bpf/bpf-next/c/087d757fb473

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html