Skip to content

Commit 53ebef5

Browse files
shunghsiyuanakryiko
authored andcommitted
bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index
The calculation of the index used to access the mask field in 'struct bpf_raw_tp_null_args' is done with 'int' type, which could overflow when the tracepoint being attached has more than 8 arguments. While none of the tracepoints mentioned in raw_tp_null_args[] currently have more than 8 arguments, there do exist tracepoints that had more than 8 arguments (e.g. iocost_iocg_forgive_debt), so use the correct type for calculation and avoid Smatch static checker warning. Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/bpf/20250418074946.35569-1-shung-hsi.yu@suse.com Closes: https://lore.kernel.org/r/843a3b94-d53d-42db-93d4-be10a4090146@stanley.mountain/
1 parent 5cffad0 commit 53ebef5

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

kernel/bpf/btf.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -6829,10 +6829,10 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
68296829
/* Is this a func with potential NULL args? */
68306830
if (strcmp(tname, raw_tp_null_args[i].func))
68316831
continue;
6832-
if (raw_tp_null_args[i].mask & (0x1 << (arg * 4)))
6832+
if (raw_tp_null_args[i].mask & (0x1ULL << (arg * 4)))
68336833
info->reg_type |= PTR_MAYBE_NULL;
68346834
/* Is the current arg IS_ERR? */
6835-
if (raw_tp_null_args[i].mask & (0x2 << (arg * 4)))
6835+
if (raw_tp_null_args[i].mask & (0x2ULL << (arg * 4)))
68366836
ptr_err_raw_tp = true;
68376837
break;
68386838
}

0 commit comments

Comments
 (0)