> diff --git a/kernel/bpf/stream.c b/kernel/bpf/stream.c
> index 09471a605268..7a5c3ac8676b 100644
> --- a/kernel/bpf/stream.c
> +++ b/kernel/bpf/stream.c
[ ... ]
> @@ -245,6 +245,11 @@ __bpf_kfunc int bpf_stream_vprintk(int stream_id, const
> char *fmt__str, const vo
> return ret;
>
> ret = bstr_printf(data.buf, MAX_BPRINTF_BUF, fmt__str, data.bin_args);
> + /* Truncation: reject before capacity charge (not -ENOMEM). */
> + if (ret >= MAX_BPRINTF_BUF) {
> + bpf_bprintf_cleanup(&data);
> + return -E2BIG;
> + }
> /* Exclude NULL byte during push. */
> ret = bpf_stream_push_str(stream, data.buf, ret);
> bpf_bprintf_cleanup(&data);
This isn't a bug, but could the truncation case set ret = -E2BIG and
fall through to the existing bpf_bprintf_cleanup(), so the buffer release
stays in one place?
The single-cleanup pattern appears elsewhere in this area:
bpf_stream_stage_printk() has one bpf_put_buffers() at the end, and
bpf_bprintf_prepare() funnels every failure through 'goto out'.
Something like:
if (ret >= MAX_BPRINTF_BUF)
ret = -E2BIG;
else
ret = bpf_stream_push_str(stream, data.buf, ret);
bpf_bprintf_cleanup(&data);
return ret;
would keep the release in one place.
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/32645868670
