Re: [PATCH v2 bpf-next 2/3] bpftool: Update func representation to include function signature

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: btf_locsec_append hides truncation marker due to null byte gap
--

commit 6f503008243b4dfc886859b905f8a6fa7b657ef2
Author: Alan Maguire <alan.maguire@oracle.com>

bpftool: Update func representation to include function signature

This commit augments the func= output for LOCSEC entries to include a mapping
from function signature to where parameters are stored. It addresses a feature
suggestion to dump LOC_PARAM, LOC_PROTO and LOCSEC more verbosely.

> diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c
> index e29c8a84e224c..ce4c4036c2796 100644
> --- a/tools/bpf/bpftool/btf.c
> +++ b/tools/bpf/bpftool/btf.c

[ ... ]

> +static bool btf_locsec_append(char *str, size_t sz, size_t *off,
> +			      const char *suffix)
> +{
> +	size_t len;
> +
> +	if (!sz || *off >= sz)
> +		return false;
> +
> +	len = strlen(suffix);
> +	if (len < sz - *off) {
> +		memcpy(str + *off, suffix, len + 1);
> +		*off += len;
> +		return true;
> +	}
> +
> +	if (sz >= 4) {
> +		memcpy(str + sz - 4, "...", 4);
> +	} else if (sz > 1) {

[Severity: Medium]
When a string exceeds the buffer size and we hit this fallback path in
btf_locsec_append(), is there a risk that the truncation marker is hidden?

The truncation marker ... is unconditionally placed at the very end of the
buffer (sz - 4). Because the function fails to copy the prefix of the string
that would fit and does not write over the existing null terminator at *off,
a gap of null bytes can separate the current end of the string from the
truncation marker.

String reading functions like printf or JSON dumpers will terminate at the
first null byte, which would completely hide the ... marker and discard the
partial data.

This would be triggered when bpftool formats a BTF location string (for 
example, a function signature with many parameters) that cumulatively exceeds
1024 characters.

> +		memset(str, '.', sz - 1);
> +		str[sz - 1] = '\0';
> +	}
> +	*off = sz - 1;
> +	return false;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925170854.1240637-1-alan.maguire@oracle.com?part=2