If readlink() fails, len will be -1, which can cause negative indexing
and undefined behavior. This patch ensures that len is set to 0 on
readlink failure, preventing such issues.

Signed-off-by: Ruslan Semchenko <uncleruc2075@gmail.com>
---
 tools/bpf/bpf_jit_disasm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/bpf/bpf_jit_disasm.c b/tools/bpf/bpf_jit_disasm.c
index 1baee9e2aba9..5ab8f80e2834 100644
--- a/tools/bpf/bpf_jit_disasm.c
+++ b/tools/bpf/bpf_jit_disasm.c
@@ -45,6 +45,8 @@ static void get_exec_path(char *tpath, size_t size)
 	assert(path);
 
 	len = readlink(path, tpath, size);
+	if (len < 0)
+		len = 0;
 	tpath[len] = 0;
 
 	free(path);
-- 
2.49.0

On 6/12/25 3:18 PM, Ruslan Semchenko wrote:
> If readlink() fails, len will be -1, which can cause negative indexing
> and undefined behavior. This patch ensures that len is set to 0 on
> readlink failure, preventing such issues.
> 
> Signed-off-by: Ruslan Semchenko <uncleruc2075@gmail.com>

Looks reasonable, thanks! When applying patch $subj can be tweaked into:

   "tools/bpf_jit_disasm: Fix potential negative tpath index in get_exec_path()"

(bpf-next tree is fine)

Acked-by: Daniel Borkmann <daniel@iogearbox.net>

> ---
>   tools/bpf/bpf_jit_disasm.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/tools/bpf/bpf_jit_disasm.c b/tools/bpf/bpf_jit_disasm.c
> index 1baee9e2aba9..5ab8f80e2834 100644
> --- a/tools/bpf/bpf_jit_disasm.c
> +++ b/tools/bpf/bpf_jit_disasm.c
> @@ -45,6 +45,8 @@ static void get_exec_path(char *tpath, size_t size)
>   	assert(path);
>   
>   	len = readlink(path, tpath, size);
> +	if (len < 0)
> +		len = 0;
>   	tpath[len] = 0;
>   
>   	free(path);