Skip to content

Commit c6018fc

Browse files
Dan Carpenterborkmann
authored andcommitted
libbpf: Fix sign expansion bug in btf_dump_get_enum_value()
The code here is supposed to take a signed int and store it in a signed long long. Unfortunately, the way that the type promotion works with this conditional statement is that it takes a signed int, type promotes it to a __u32, and then stores that as a signed long long. The result is never negative. This is from static analysis, but I made a little test program just to test it before I sent the patch: #include <stdio.h> int main(void) { unsigned long long src = -1ULL; signed long long dst1, dst2; int is_signed = 1; dst1 = is_signed ? *(int *)&src : *(unsigned int *)0; dst2 = is_signed ? (signed long long)*(int *)&src : *(unsigned int *)0; printf("%lld\n", dst1); printf("%lld\n", dst2); return 0; } Fixes: d90ec26 ("libbpf: Add enum64 support for btf_dump") Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Acked-by: Martin KaFai Lau <[email protected]> Link: https://lore.kernel.org/bpf/YtZ+LpgPADm7BeEd@kili
1 parent 9cb61fd commit c6018fc

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

tools/lib/bpf/btf_dump.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2045,7 +2045,7 @@ static int btf_dump_get_enum_value(struct btf_dump *d,
20452045
*value = *(__s64 *)data;
20462046
return 0;
20472047
case 4:
2048-
*value = is_signed ? *(__s32 *)data : *(__u32 *)data;
2048+
*value = is_signed ? (__s64)*(__s32 *)data : *(__u32 *)data;
20492049
return 0;
20502050
case 2:
20512051
*value = is_signed ? *(__s16 *)data : *(__u16 *)data;

0 commit comments

Comments
 (0)