mirror/libbpf
1
0
Fork 0
mirror of https://github.com/netdata/libbpf.git synced 2026-03-13 21:09:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

libbpf: Fix OOB read in btf_dump_get_bitfield_value

Browse Source 
When dumping bitfield data, btf_dump_get_bitfield_value() reads data
based on the underlying type's size (t->size). However, it does not
verify that the provided data buffer (data_sz) is large enough to
contain these bytes.

If btf_dump__dump_type_data() is called with a buffer smaller than
the type's size, this leads to an out-of-bounds read. This was
confirmed by AddressSanitizer in the linked issue.

Fix this by ensuring we do not read past the provided data_sz limit.

Fixes: a1d3cc3c5eca ("libbpf: Avoid use of __int128 in typed dump display")
Reported-by: Harrison Green <harrisonmichaelgreen@gmail.com>
Suggested-by: Alan Maguire <alan.maguire@oracle.com>
Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260106233527.163487-1-varunrmallya@gmail.com

Closes: https://github.com/libbpf/libbpf/issues/928
This commit is contained in:
Varun R Mallya
2026-01-07 05:05:27 +05:30
committed by Andrii Nakryiko
parent dc8673b28b
commit 2c5038dcf4
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/btf_dump.c
View File

@@ -1762,9 +1762,18 @@ static int btf_dump_get_bitfield_value(struct btf_dump *d,
__u16 left_shift_bits, right_shift_bits; __u16 left_shift_bits, right_shift_bits;
const __u8 *bytes = data; const __u8 *bytes = data;
__u8 nr_copy_bits; __u8 nr_copy_bits;
__u8 start_bit, nr_bytes;
__u64 num = 0; __u64 num = 0;
int i; int i;
/* Calculate how many bytes cover the bitfield */
start_bit = bits_offset % 8;
nr_bytes = (start_bit + bit_sz + 7) / 8;
/* Bound check */
if (data + nr_bytes > d->typed_dump->data_end)
return -E2BIG;
/* Maximum supported bitfield size is 64 bits */ /* Maximum supported bitfield size is 64 bits */
if (t->size > 8) { if (t->size > 8) {
pr_warn("unexpected bitfield size %d\n", t->size); pr_warn("unexpected bitfield size %d\n", t->size);