Re: [PATCH bpf-next v3 1/2] bpf: add bpf_strncasecmp kfunc

[Viktor Malik <vmalik@redhat.com>]

On 1/20/26 08:21, bot+bpf-ci@kernel.org wrote:
>> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
>> index 9eaa4185e0a7..753753f039ff 100644
>> --- a/kernel/bpf/helpers.c
>> +++ b/kernel/bpf/helpers.c
> 
> [ ... ]
> 
>> -static int __bpf_strcasecmp(const char *s1, const char *s2, bool ignore_case)
>> +static int __bpf_strncasecmp(const char *s1, const char *s2, bool ignore_case, size_t len)
>>  {
>>  	char c1, c2;
>> -	int i;
>> +	int i, max_sz;
>>
>>  	if (!copy_from_kernel_nofault_allowed(s1, 1) ||
>>  	    !copy_from_kernel_nofault_allowed(s2, 1)) {
>>  		return -ERANGE;
>>  	}
>>
>> +	max_sz = min_t(int, len, XATTR_SIZE_MAX);
>                    ^^^
> 
> Can this truncation cause incorrect results when len > INT_MAX? The len
> parameter is size_t, but min_t(int, ...) casts it to signed int before the
> comparison. When len is larger than INT_MAX, the cast produces a negative
> value, and min_t returns that negative value instead of XATTR_SIZE_MAX.
> 
> For example, if a BPF program calls bpf_strncasecmp(s1, s2, SIZE_MAX):
> - min_t(int, SIZE_MAX, 65536) evaluates to min_t(int, -1, 65536) = -1
> - max_sz becomes -1
> - The loop condition (i < max_sz) is (0 < -1), which is false
> - The loop never executes, and the function returns 0 without comparing
> 
> This would make bpf_strncasecmp("foo", "bar", SIZE_MAX) return 0 (equal)
> when the strings are clearly different.

This is a good point and we should IMO address it.

> 
> Would using min_t(size_t, len, XATTR_SIZE_MAX) avoid this issue?

Other string kfuncs use `i < len && i < XATTR_SIZE_MAX` in the loop
condition, I'd stick to that for consistency.

Viktor

> 
>> +
>>  	guard(pagefault)();
>> -	for (i = 0; i < XATTR_SIZE_MAX; i++) {
>> +	for (i = 0; i < max_sz; i++) {
> 
> [ ... ]
> 
>> +__bpf_kfunc int bpf_strncasecmp(const char *s1__ign, const char *s2__ign, size_t len)
>> +{
>> +	return __bpf_strncasecmp(s1__ign, s2__ign, true, len);
>>  }
> 
> The BPF verifier does not validate ranges for scalar kfunc parameters, so
> BPF programs can pass arbitrary size_t values to len, triggering the
> truncation issue described above.
> 
> 
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
> 
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21162711653