]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
libbpf: Fix OOB read in btf_dump_get_bitfield_value
authorVarun R Mallya <varunrmallya@gmail.com>
Tue, 6 Jan 2026 23:35:27 +0000 (05:05 +0530)
committerAndrii Nakryiko <andrii@kernel.org>
Fri, 9 Jan 2026 23:54:31 +0000 (15:54 -0800)
commit5714ca8cba5ed736f3733663c446cbee63a10a64
tree90d84b1f46b7158b0d8873016e2def3959df6030
parent4effccde0a0521b220c3585c9a0d8e677d345209
libbpf: Fix OOB read in btf_dump_get_bitfield_value

When dumping bitfield data, btf_dump_get_bitfield_value() reads data
based on the underlying type's size (t->size). However, it does not
verify that the provided data buffer (data_sz) is large enough to
contain these bytes.

If btf_dump__dump_type_data() is called with a buffer smaller than
the type's size, this leads to an out-of-bounds read. This was
confirmed by AddressSanitizer in the linked issue.

Fix this by ensuring we do not read past the provided data_sz limit.

Fixes: a1d3cc3c5eca ("libbpf: Avoid use of __int128 in typed dump display")
Reported-by: Harrison Green <harrisonmichaelgreen@gmail.com>
Suggested-by: Alan Maguire <alan.maguire@oracle.com>
Signed-off-by: Varun R Mallya <varunrmallya@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20260106233527.163487-1-varunrmallya@gmail.com
Closes: https://github.com/libbpf/libbpf/issues/928
tools/lib/bpf/btf_dump.c