Commit 4172843e authored by Dan Carpenter's avatar Dan Carpenter Committed by Daniel Borkmann
Browse files

libbpf: Fix signedness bug in btf_dump_array_data() 



The btf__resolve_size() function returns negative error codes so
"elem_size" must be signed for the error handling to work.

Fixes: 920d16af ("libbpf: BTF dumper support for typed data")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarYonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20220208071552.GB10495@kili
parent 5912fcb4

tools/lib/bpf/btf_dump.c

+3 −2
Original line number Diff line number Diff line
@@ -1861,14 +1861,15 @@ static int btf_dump_array_data(struct btf_dump *d, 
{

	const struct btf_array *array = btf_array(t);

	const struct btf_type *elem_type;

	__u32 i, elem_size = 0, elem_type_id;

	__u32 i, elem_type_id;

	__s64 elem_size;

	bool is_array_member;



	elem_type_id = array->type;

	elem_type = skip_mods_and_typedefs(d->btf, elem_type_id, NULL);

	elem_size = btf__resolve_size(d->btf, elem_type_id);

	if (elem_size <= 0) {

		pr_warn("unexpected elem size %d for array type [%u]\n", elem_size, id);

		pr_warn("unexpected elem size %lld for array type [%u]\n", elem_size, id);

		return -EINVAL;

	}