Re: [PATCH bpf-next 1/3] btf: Fix size/vlen validation for BTF_KIND_LOC_PARAM

[Jiri Olsa <olsajiri@gmail.com>]

On Mon, Oct 12, 2026 at 03:06:38PM +0100, Alan Maguire wrote:
> Validation logic allowed a BTF_KIND_LOC_PARAM with size <= 4
> and vlen == 2, an inconsistent representation.
> 
> Fixes: a3df11403e8c8 ("bpf: Verify BTF_KIND_LOC_PARAM vlen, flags")
> Suggested-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
> ---
>  kernel/bpf/btf.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index b09c04ccdc6d..64c78434fa05 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -4827,12 +4827,12 @@ static s32 btf_loc_param_check_meta(struct btf_verifier_env *env,
>  	case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_SIGNED:
>  	case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR:
>  	case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR | BTF_LOC_PARAM_SIGNED:
> -		if (vlen > 2)
> +		if (vlen < 1 || vlen > 2)
>  			goto invalid_vlen;

nit, is this condition needed? the check down ensures vlen is 1 or 2

jirka

> -		/* Ensure size/vlen are consistent */
> -		if (size > sizeof(__u32) && vlen != 2)
> +		if (!size || size > sizeof(__u64))
>  			goto invalid_vlen;
> -		if (size > sizeof(__u64))
> +		/* Ensure size/vlen are consistent */
> +		if (vlen != (size > sizeof(__u32) ? 2 : 1))
>  			goto invalid_vlen;
>  		break;
>  	case BTF_LOC_PARAM_REG:
> -- 
> 2.43.5
>