[PATCH] libbpf: Check full backing type size for bitfield dump

[Guangshuo Li]

btf_dump_get_bitfield_value() builds a bitfield value by reading bytes
from the backing integer type. The bounds check added for short data
buffers uses the number of bytes covered by the bitfield itself, but the
read loop consumes the full backing type width.

For narrow bitfields this can leave part of the backing type unchecked.
For example, a one-bit field backed by a four-byte integer only requires
one byte according to the bitfield span calculation, while the value
construction still reads four bytes.

Check the backing type size instead, so the bounds check matches the
actual read range.

Fixes: 5714ca8cba5e ("libbpf: Fix OOB read in btf_dump_get_bitfield_value")
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 tools/lib/bpf/btf_dump.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
index cc1ba65bb6c5..a49790e356a8 100644
--- a/tools/lib/bpf/btf_dump.c
+++ b/tools/lib/bpf/btf_dump.c
@@ -1771,7 +1771,7 @@ static int btf_dump_get_bitfield_value(struct btf_dump *d,
 	nr_bytes = (start_bit + bit_sz + 7) / 8;
 
 	/* Bound check */
-	if (data + nr_bytes > d->typed_dump->data_end)
+	if (data + t->size > d->typed_dump->data_end)
 		return -E2BIG;
 
 	/* Maximum supported bitfield size is 64 bits */
-- 
2.43.0