Re: [PATCH v2 bpf-next 2/3] bpftool: Update func representation to include function signature

[Quentin Monnet <qmo@kernel.org>]

2026-09-25 17:17 UTC+0000 ~ sashiko-bot@kernel.org
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] bpf: btf_locsec_append hides truncation marker due to null byte gap
> --
> 
> commit 6f503008243b4dfc886859b905f8a6fa7b657ef2
> Author: Alan Maguire <alan.maguire@oracle.com>
> 
> bpftool: Update func representation to include function signature
> 
> This commit augments the func= output for LOCSEC entries to include a mapping
> from function signature to where parameters are stored. It addresses a feature
> suggestion to dump LOC_PARAM, LOC_PROTO and LOCSEC more verbosely.
> 
>> diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c
>> index e29c8a84e224c..ce4c4036c2796 100644
>> --- a/tools/bpf/bpftool/btf.c
>> +++ b/tools/bpf/bpftool/btf.c
> 
> [ ... ]
> 
>> +static bool btf_locsec_append(char *str, size_t sz, size_t *off,
>> +			      const char *suffix)
>> +{
>> +	size_t len;
>> +
>> +	if (!sz || *off >= sz)
>> +		return false;
>> +
>> +	len = strlen(suffix);
>> +	if (len < sz - *off) {
>> +		memcpy(str + *off, suffix, len + 1);
>> +		*off += len;
>> +		return true;
>> +	}
>> +
>> +	if (sz >= 4) {
>> +		memcpy(str + sz - 4, "...", 4);
>> +	} else if (sz > 1) {
> 
> [Severity: Medium]
> When a string exceeds the buffer size and we hit this fallback path in
> btf_locsec_append(), is there a risk that the truncation marker is hidden?
> 
> The truncation marker ... is unconditionally placed at the very end of the
> buffer (sz - 4). Because the function fails to copy the prefix of the string
> that would fit and does not write over the existing null terminator at *off,
> a gap of null bytes can separate the current end of the string from the
> truncation marker.
> 
> String reading functions like printf or JSON dumpers will terminate at the
> first null byte, which would completely hide the ... marker and discard the
> partial data.
> 
> This would be triggered when bpftool formats a BTF location string (for 
> example, a function signature with many parameters) that cumulatively exceeds
> 1024 characters.

Maybe copy whatever we can from the suffix first, overwrite the end with
the dots after? Something like:

        if (sz >= 4) {
                size_t space_left = sz - 1 - *off;

                if (space_left)
                        memcpy(str + *off, suffix, space_left);
                memcpy(str + sz - 4, "...", 4);
        }