Re: [PATCH bpf-next v4 4/5] bpf: reject oversized bpf_stream_vprintk output with -E2BIG

> diff --git a/kernel/bpf/stream.c b/kernel/bpf/stream.c
> index 09471a605268..7a5c3ac8676b 100644
> --- a/kernel/bpf/stream.c
> +++ b/kernel/bpf/stream.c

[ ... ]

> @@ -245,6 +245,11 @@ __bpf_kfunc int bpf_stream_vprintk(int stream_id, const char *fmt__str, const vo
>  		return ret;
>
>  	ret = bstr_printf(data.buf, MAX_BPRINTF_BUF, fmt__str, data.bin_args);
> +	/* Truncation: reject before capacity charge (not -ENOMEM). */
> +	if (ret >= MAX_BPRINTF_BUF) {
> +		bpf_bprintf_cleanup(&data);
> +		return -E2BIG;
> +	}
>  	/* Exclude NULL byte during push. */
>  	ret = bpf_stream_push_str(stream, data.buf, ret);
>  	bpf_bprintf_cleanup(&data);

This isn't a bug, but could the truncation case set ret = -E2BIG and
fall through to the existing bpf_bprintf_cleanup(), so the buffer release
stays in one place?

The single-cleanup pattern appears elsewhere in this area:
bpf_stream_stage_printk() has one bpf_put_buffers() at the end, and
bpf_bprintf_prepare() funnels every failure through 'goto out'.

Something like:

	if (ret >= MAX_BPRINTF_BUF)
		ret = -E2BIG;
	else
		ret = bpf_stream_push_str(stream, data.buf, ret);
	bpf_bprintf_cleanup(&data);
	return ret;

would keep the release in one place.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32645868670