On Wed, Sep 2, 2026 at 2:11 AM Mark Amirkan <[email protected]> wrote: > > btf_type_size_unknown() returns an int, but calculates the type record > size using unsigned operands. With a 24-bit vlen, an unknown kind whose > vlen is 0xffffff and whose info and element sizes are both 252 has a > record size of 0xfc00000c. Converting this value to int produces > -67108852. > > btf_parse_type_sec() returns the negative value, and btf_new() encodes it > with ERR_PTR(). Since the value is outside the error-pointer range, > libbpf_ptr() does not recognize it as an error. On a 64-bit system, a > 129-byte raw BTF input makes btf__new() return 0xfffffffffc00000c while > libbpf_get_error() returns zero and errno remains zero. Calling > btf__type_cnt() or btf__free() on the result crashes. The same input > makes bpftool's "btf dump file" command terminate with SIGSEGV. > > Calculate the record size as size_t and reject values above INT_MAX > before converting it to int. Add a regression test for the maximum-vlen > unknown kind. > > Fixes: cacd6729c092 ("libbpf: Adjust btf_vlen() to return a __u32") > Assisted-by: Symbolic > Signed-off-by: Mark Amirkan <[email protected]> > --- > Testing: > - normal builds of libbpf and bpftool, plus an ASan/UBSan libbpf build; > - the reproducer through btf__new() and bpftool; > - the added btf_kind test and the existing encoding/decoding subtests; > - identical bpftool output before and after the fix for all 60 BTF blobs > under /sys/kernel/btf on the test system. > > The complete BPF selftest suite was not run locally because clang was not > available.
that's ok, I hope AI wasn't too stressed about this unfortunate state of things... we are not going to harden libbpf against any possible malicious corruption of BTF contents. If you don't trust the source of data, don't pass it to libbpf (or do it in a VM or some such). pw-bot: cr > > This fixes code present in Linux v7.2; please consider it for stable. > Do you use libbpf in practice? and where do you get its source code from, if so? > tools/lib/bpf/btf.c | 11 +++++- > .../selftests/bpf/prog_tests/btf_kind.c | 39 +++++++++++++++++++ > 2 files changed, 49 insertions(+), 1 deletion(-) > [...]
