linux-kernel - Re: [PATCH bpf-next] libbpf: Ignore the modules that failed to load BTF object

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b2b8eda3-2b36-4784-a4b2-1275f3a26e43@vivo.com>
Date: Wed, 29 Oct 2025 09:35:51 +0800
From: Bixuan Cui <cuibixuan@...o.com>
To: Alan Maguire <alan.maguire@...cle.com>,
 Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc: ast@...nel.org, daniel@...earbox.net, andrii@...nel.org,
 martin.lau@...ux.dev, bpf@...r.kernel.org, linux-kernel@...r.kernel.org,
 eddyz87@...il.com, song@...nel.org, yonghong.song@...ux.dev,
 john.fastabend@...il.com, kpsingh@...nel.org, sdf@...ichev.me,
 haoluo@...gle.com, jolsa@...nel.org
Subject: Re: [PATCH bpf-next] libbpf: Ignore the modules that failed to load
 BTF object

在 2025/10/29 2:21, Alan Maguire 写道:
>> It's not an expected condition to have kernel module with corrupted
>> BTF, so I don't think we should be doing this.
>>
>> pw-bot: cr
>>
> Would be good to understand this failure better. If the module is being
> built out-of-tree with relatively new pahole, it will have a .BTF.base
> section and a .BTF section; the .BTF.base section allows the module to
> carry stable references to vmlinux BTF types which then get fixed up to
> the real vmlinux BTF id references when the module is loaded. It is
> possible there are bugs in that code however, so it woul be good to
> figure that out. bpftool should dump BTF for your module using the
> .BTF.base section as base, so
> 
> bpftool btf dump file mymod.ko
> 
> should work (provided "objdump -h mymod.ko" shows a .BTF.base and .BTF
> section).  If it does, the BTF id relocation may be breaking and we
> might need to do further digging to understand where. It should relocate
> BTF kfunc ids also, but again there may be a bug lurking here.
> 
> If the BTF is loading into the kernel, comparing
> 
> bpftool btf dump -B /sys/kernel/btf file /sys/kernel/btf/mymod
> 
> ...to the .ko BTF would be valuable.
> 
> If your module only has a .BTF section and no .BTF.base section, it is
> possible it did not get (re)built against an updated vmlinux and has
> outdated type id references as a result.
Thank you, I will first look at the error reported by this module.

Bixuan Cui