[PATCH bpf] tools: bpftool: fix truncated netlink dumps

[PATCH bpf] tools: bpftool: fix truncated netlink dumps

[Jakub Kicinski]

Netlink requires that the recv buffer used during dumps is at least
min(PAGE_SIZE, 8k) (see the man page). Otherwise the messages will
get truncated. Make sure bpftool follows this requirement, avoid
missing information on systems with large pages.

Fixes: 7084566a236f ("tools/bpftool: Remove libbpf_internal.h usage in bpftool")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: qmo@kernel.org
CC: ast@kernel.org
CC: daniel@iogearbox.net
CC: andrii@kernel.org
CC: martin.lau@linux.dev
CC: eddyz87@gmail.com
CC: song@kernel.org
CC: yonghong.song@linux.dev
CC: john.fastabend@gmail.com
CC: kpsingh@kernel.org
CC: sdf@fomichev.me
CC: haoluo@google.com
CC: jolsa@kernel.org
CC: bpf@vger.kernel.org
---
 tools/bpf/bpftool/net.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
index cfc6f944f7c3..7f248fc01332 100644
--- a/tools/bpf/bpftool/net.c
+++ b/tools/bpf/bpftool/net.c
@@ -156,7 +156,7 @@ static int netlink_recv(int sock, __u32 nl_pid, __u32 seq,
 	bool multipart = true;
 	struct nlmsgerr *err;
 	struct nlmsghdr *nh;
-	char buf[4096];
+	char buf[8192];
 	int len, ret;
 
 	while (multipart) {
@@ -201,6 +201,10 @@ static int netlink_recv(int sock, __u32 nl_pid, __u32 seq,
 					return ret;
 			}
 		}
+
+		if (len)
+	                fprintf(stderr, "Invalid message or trailing data in Netlink response: %d\n",
+				len);
 	}
 	ret = 0;
 done:
-- 
2.52.0

Re: [PATCH bpf] tools: bpftool: fix truncated netlink dumps

[Quentin Monnet]

On 05/12/2025 01:18, Jakub Kicinski wrote:
> Netlink requires that the recv buffer used during dumps is at least
> min(PAGE_SIZE, 8k) (see the man page). Otherwise the messages will
> get truncated. Make sure bpftool follows this requirement, avoid
> missing information on systems with large pages.
> 
> Fixes: 7084566a236f ("tools/bpftool: Remove libbpf_internal.h usage in bpftool")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> CC: qmo@kernel.org
> CC: ast@kernel.org
> CC: daniel@iogearbox.net
> CC: andrii@kernel.org
> CC: martin.lau@linux.dev
> CC: eddyz87@gmail.com
> CC: song@kernel.org
> CC: yonghong.song@linux.dev
> CC: john.fastabend@gmail.com
> CC: kpsingh@kernel.org
> CC: sdf@fomichev.me
> CC: haoluo@google.com
> CC: jolsa@kernel.org
> CC: bpf@vger.kernel.org
> ---
>  tools/bpf/bpftool/net.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
> index cfc6f944f7c3..7f248fc01332 100644
> --- a/tools/bpf/bpftool/net.c
> +++ b/tools/bpf/bpftool/net.c
> @@ -156,7 +156,7 @@ static int netlink_recv(int sock, __u32 nl_pid, __u32 seq,
>  	bool multipart = true;
>  	struct nlmsgerr *err;
>  	struct nlmsghdr *nh;
> -	char buf[4096];
> +	char buf[8192];
>  	int len, ret;
>  
>  	while (multipart) {
> @@ -201,6 +201,10 @@ static int netlink_recv(int sock, __u32 nl_pid, __u32 seq,
>  					return ret;
>  			}
>  		}
> +
> +		if (len)
> +	                fprintf(stderr, "Invalid message or trailing data in Netlink response: %d\n",
> +				len);


Hi, it's been a while, thanks! :)

Can you please use p_err() rather than fprintf()? I'd also add what the
printed value is, for example:

    p_err("Invalid message or trailing data in Netlink response: %d bytes left", len);

Can you please also check function libbpf_netlink_recv() in
tools/lib/bpf/netlink.c? That's where the one in bpftool comes from and
it seems it has the same issue.

Thanks,
Quentin