linux-kernel - Re: [PATCH v5 2/7] libbpf: Add BTF permutation support for type reordering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAErzpmt0L6hS8W0xXznrVY8dLJN_opS8ZyyorT3m7yyANLQ9Cw@mail.gmail.com>
Date: Fri, 7 Nov 2025 15:12:48 +0800
From: Donglin Peng <dolinux.peng@...il.com>
To: bot+bpf-ci@...nel.org
Cc: ast@...nel.org, eddyz87@...il.com, andrii.nakryiko@...il.com, 
	zhangxiaoqin@...omi.com, linux-kernel@...r.kernel.org, bpf@...r.kernel.org, 
	alan.maguire@...cle.com, song@...nel.org, pengdonglin@...omi.com, 
	andrii@...nel.org, daniel@...earbox.net, martin.lau@...nel.org, 
	yonghong.song@...ux.dev, clm@...a.com, ihor.solodrai@...ux.dev
Subject: Re: [PATCH v5 2/7] libbpf: Add BTF permutation support for type reordering

On Thu, Nov 6, 2025 at 9:47 PM <bot+bpf-ci@...nel.org> wrote:
>
> > diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
> > index 9c389b2c8..97451a929 100644
> > --- a/tools/lib/bpf/btf.c
> > +++ b/tools/lib/bpf/btf.c
>
> [ ... ]
>
> > +int btf__permute(struct btf *btf, __u32 *ids, __u32 ids_sz, const struct btf_permute_opts *opts)
> > +{
> > +     struct btf_permute p;
> > +     int err = 0;
> > +     __u32 *ids_map = NULL;
> > +
> > +     if (!OPTS_VALID(opts, btf_permute_opts) || (ids_sz > btf->nr_types))
> > +             return libbpf_err(-EINVAL);
> > +
> > +     ids_map = calloc(ids_sz, sizeof(*ids_map));
>
> Can ids_map overflow here in btf_permute_shuffle_types()?
>
> The ids_map array is allocated with ids_sz elements, giving valid
> indices from 0 to ids_sz-1. However, in btf_permute_shuffle_types()
> the code accesses:
>
>     ids_map = &p->ids_map[id - btf->start_id]
>
> where 'id' is validated only to be in range [btf->start_id,
> btf->start_id + btf->nr_types). When ids_sz < btf->nr_types
> (truncation case) and a user provides a type ID where
> (id - btf->start_id) >= ids_sz, this results in an out-of-bounds
> write to ids_map.
>
> For example, with start_id=1, nr_types=100, and ids_sz=50:
> - ids_map has 50 elements (indices 0-49)
> - If user includes type ID 75 in the ids array
> - btf__type_by_id(btf, 75) succeeds (75 < 101)
> - ids_map[75-1] = ids_map[74] writes beyond the array
>

Thanks, I will fix it.

> The same issue occurs in btf_permute_remap_type_id() where the code
> reads from ids_map without validating the index is within ids_sz:
>
>     new_type_id = p->ids_map[*type_id - p->btf->start_id]
>
> If any included type references a type ID beyond ids_sz, this reads
> uninitialized memory (or out-of-bounds if the ID is >= ids_sz +
> start_id).

Thanks, I will fix it.

>
> > +     if (!ids_map) {
> > +             err = -ENOMEM;
> > +             goto done;
> > +     }
> > +
> > +     p.btf = btf;
> > +     p.btf_ext = OPTS_GET(opts, btf_ext, NULL);
> > +     p.ids = ids;
> > +     p.ids_map = ids_map;
> > +     p.ids_sz = ids_sz;
> > +
> > +     if (btf_ensure_modifiable(btf)) {
> > +             err = -ENOMEM;
> > +             goto done;
> > +     }
> > +     err = btf_permute_shuffle_types(&p);
> > +     if (err < 0) {
> > +             goto done;
> > +     }
> > +     err = btf_permute_remap_types(&p);
> > +     if (err < 0) {
> > +             goto done;
> > +     }
> > +
> > +done:
> > +     free(ids_map);
> > +     return libbpf_err(err);
> > +}
>
> [ ... ]
>
> > +static int btf_permute_shuffle_types(struct btf_permute *p)
> > +{
> > +     struct btf *btf = p->btf;
> > +     const struct btf_type *t;
> > +     __u32 *new_offs = NULL, *ids_map;
> > +     void *nt, *new_types = NULL;
> > +     int i, id, len, err;
> > +
> > +     new_offs = calloc(p->ids_sz, sizeof(*new_offs));
> > +     new_types = calloc(btf->hdr->type_len, 1);
> > +     if (!new_offs || !new_types) {
> > +             err = -ENOMEM;
> > +             goto out_err;
> > +     }
> > +
> > +     nt = new_types;
> > +     for (i = 0; i < p->ids_sz; i++) {
> > +             id = p->ids[i];
> > +             /* type IDs from base_btf and the VOID type are not allowed */
> > +             if (id < btf->start_id) {
> > +                     err = -EINVAL;
> > +                     goto out_err;
> > +             }
> > +             /* must be a valid type ID */
> > +             t = btf__type_by_id(btf, id);
> > +             if (!t) {
> > +                     err = -EINVAL;
> > +                     goto out_err;
> > +             }
> > +             ids_map = &p->ids_map[id - btf->start_id];
> > +             /* duplicate type IDs are not allowed */
> > +             if (*ids_map) {
> > +                     err = -EINVAL;
> > +                     goto out_err;
> > +             }
> > +             len = btf_type_size(t);
> > +             memcpy(nt, t, len);
> > +             new_offs[i] = nt - new_types;
> > +             *ids_map = btf->start_id + i;
> > +             nt += len;
> > +     }
>
> [ ... ]
>
> > +static int btf_permute_remap_type_id(__u32 *type_id, void *ctx)
> > +{
> > +     struct btf_permute *p = ctx;
> > +     __u32 new_type_id = *type_id;
> > +
> > +     /* skip references that point into the base BTF */
> > +     if (new_type_id < p->btf->start_id)
> > +             return 0;
> > +
> > +     new_type_id = p->ids_map[*type_id - p->btf->start_id];
> > +     if (new_type_id > BTF_MAX_NR_TYPES)
> > +             return -EINVAL;
> > +
> > +     *type_id = new_type_id;
> > +     return 0;
> > +}
>
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/19137195500