From nobody Sat Sep 26 21:12:58 2026 Received: from mta0.migadu.com (out-20.mta0.migadu.com [91.218.175.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4B7C235F170 for ; Sun, 30 Aug 2026 07:33:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.20 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788075210; cv=none; b=eXgCvEOiJqKZsMBl9/2H/P4XFrtXN7XtQ1zGSRlJa4EmMek574TQP8K9wnWwJeNfkUSyxFwP1wR1LzYJ0sG8+cyJKDGfmtBbrM5LKyQ7h00Da/3WufaHRx/DJGMG2N2lpSJk0f0MCqK7El1AaDOoyhc23gDj4k4xIfR/HC7506g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788075210; c=relaxed/simple; bh=s+hno46646Ftcg4sO1qvoDzrwEmHBxTBKiCcgLmq0KQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mdCOY4wCau3+K71lGLX6oX04/so67L8dpSu5DJDq6FJbppnJrYmoYSY73sAXGDMDFFM21RhQlhXXEhOLyX5M7huBi/kVb0vy4w4AFKZ/JEKjPAOTnz2mBIZKAKajz2SMGr6uSPzM6WDdFKInwFL7HWAqC47C1T9AkLF3Tp2gWH4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=vD21z1mF; arc=none smtp.client-ip=91.218.175.20 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="vD21z1mF" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=s+hno46646Ftcg4sO1qvoDzrwEmHBxTBKiCcgLmq0KQ=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788075205; v=1; x=1788680005; b=vD21z1mFauS+Lrxnd+BySCazay2IwmLwVSxLQWEC3H21SavkHgTM3X0Ze2mIEmZUL9bDffwQ sKZbC28QZMmHAyz/QQTdBlBAq1rcxKh7y2T730uGbKJcQpnwJW7JwVZjtdu9+qMqHKC4hBUV7Xe 79TGXGDTBYTGEHgvObJA83Gc= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id db3a522f16ad53d8; Sun, 30 Aug 2026 07:33:25 +0000 X-Mizu-Trace-ID: db3a522f16ad53d8 X-Migadu-Flow: FLOW_OUT From: Jiayuan Chen To: bpf@vger.kernel.org Cc: Jiayuan Chen , syzbot+37b56485bbbf90ad8489@syzkaller.appspotmail.com, Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , Shuah Khan , Mykyta Yatsenko , Alan Maguire , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf v2 1/4] bpf: Reject key-less BTF for hash maps Date: Sun, 30 Aug 2026 15:30:56 +0800 Message-ID: <20260830073242.148092-2-jiayuan.chen@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260830073242.148092-1-jiayuan.chen@linux.dev> References: <20260830073242.148092-1-jiayuan.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" map_check_btf() allows a key-less BTF (btf_key_type_id =3D=3D 0) only for maps that have a ->map_check_btf callback, and leaves the actual decision to that callback. Hash maps used to have no ->map_check_btf, so a key-less BTF was rejected outright. Since commit 1df97a7453ee ("bpf: Register dtor for freeing special fields") htab and rhtab got a ->map_check_btf to register a dtor, but it does not look at the key, so a key-less hash map now passes map_check_btf() and gets created. Reading it back through bpffs then feeds the key type_id 0 into btf_type_seq_show(); btf_type_by_id() returns the void type, kind_ops[BTF_KIND_UNKN] is NULL, and btf_type_show() dereferences it: KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] RIP: 0010:btf_type_show (kernel/bpf/btf.c:8251) Call Trace: btf_type_seq_show_flags (kernel/bpf/btf.c:8269) btf_type_seq_show (kernel/bpf/btf.c:8277) htab_map_seq_show_elem (kernel/bpf/hashtab.c:1669) map_seq_show (kernel/bpf/inode.c:293) seq_read_iter (fs/seq_file.c:273) seq_read (fs/seq_file.c:163) vfs_read (fs/read_write.c:572) ksys_read (fs/read_write.c:716) __x64_sys_read (fs/read_write.c:725) do_syscall_64 (arch/x86/entry/syscall_64.c:61) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Reject a key-less BTF in htab_map_check_btf() and rhtab_map_check_btf(), restoring the previous behavior. Fixes: 1df97a7453ee ("bpf: Register dtor for freeing special fields") Fixes: 6905f8601298 ("bpf: Allow special fields in resizable hashtab") Reported-by: syzbot+37b56485bbbf90ad8489@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6a8f4e88.27659fcc.2ceef7.0008.GAE@googl= e.com/T/ Signed-off-by: Jiayuan Chen --- kernel/bpf/hashtab.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index d40cb5dd446c..43123424183c 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -530,6 +530,10 @@ static int htab_map_check_btf(struct bpf_map *map, con= st struct btf *btf, { struct bpf_htab *htab =3D container_of(map, struct bpf_htab, map); =20 + /* Hash maps have no use for a key-less BTF. */ + if (btf_type_is_void(key_type)) + return -EINVAL; + if (htab_is_prealloc(htab)) return 0; /* @@ -3110,6 +3114,10 @@ static int rhtab_map_check_btf(struct bpf_map *map, = const struct btf *btf, { struct bpf_rhtab *rhtab =3D container_of(map, struct bpf_rhtab, map); =20 + /* Hash maps have no use for a key-less BTF. */ + if (btf_type_is_void(key_type)) + return -EINVAL; + return bpf_ma_set_dtor(map, &rhtab->ma, rhtab_mem_dtor); } =20 --=20 2.43.0 From nobody Sat Sep 26 21:12:58 2026 Received: from mta0.migadu.com (out-29.mta0.migadu.com [91.218.175.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 42DCF29B228 for ; Sun, 30 Aug 2026 07:33:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.29 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788075236; cv=none; b=JlxSZQgayt/R01WtWQhvjUfd5NmB+ge4yOp7UM858kVoBXCLhl+wiglz+6U/IRStTv+L5/F37/9EAuX57UwybFmnHIyORVaNBNtQiq2TxdHEhEcFq0HZ8opGgc43bo6ayAbdYUlCnNlfWTV8POrJ6th/FXUN7j8wqi0IZCYXsaY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788075236; c=relaxed/simple; bh=MZqBEMfNU2/DRjrc3AMVWf0ULkLuJij9FfiG6ryc5V8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rh+1bTzqZ0wRYW6dPeCwVEwQz8En0Ppdm6xELtufpdcAC75080KT3VrPmZCbFrGPjfgMUwivh7jUroSbo4EvKKII4+MMRp8Gqh1E8guPXJWXb9DN/kgV1LhbqqgilhjkzD61jpQ4CsmZFeAujsi0Jb7sxxh8VfnVBpVKsKFmZ0Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=iVxbcATC; arc=none smtp.client-ip=91.218.175.29 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="iVxbcATC" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=MZqBEMfNU2/DRjrc3AMVWf0ULkLuJij9FfiG6ryc5V8=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788075233; v=1; x=1788680033; b=iVxbcATCu0/arSvvnMKZBGpVVLcpggW4WdKTl3EamUPdB8ZjOBufZXIDd3L1JVEhpdFOwJ6Y 9ipgjhQ89a6Ej88nlsrSxLkrq2YS8mfjEa01r44GXaL48o1cT7SYpwPh4siN2nvvjk02FiOcUM3 0203zNnuZBXsBbYEL03553yc= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 7ad53e721c9267db; Sun, 30 Aug 2026 07:33:53 +0000 X-Mizu-Trace-ID: 7ad53e721c9267db X-Migadu-Flow: FLOW_OUT From: Jiayuan Chen To: bpf@vger.kernel.org Cc: Jiayuan Chen , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , Shuah Khan , Mykyta Yatsenko , Alan Maguire , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf v2 2/4] bpf: Fix NULL-ptr-deref when showing a void BTF type Date: Sun, 30 Aug 2026 15:30:57 +0800 Message-ID: <20260830073242.148092-3-jiayuan.chen@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260830073242.148092-1-jiayuan.chen@linux.dev> References: <20260830073242.148092-1-jiayuan.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" btf_modifier_show() resolves the modifier and then calls btf_type_ops(t)->show() unconditionally. For the void type (type_id 0, BTF_KIND_UNKN) kind_ops[] has no entry, so ->show is NULL. The map dump path cannot reach a void type (a map key/value must have a size and void has none), but bpf_snprintf_btf() takes a type_id straight from the BPF program, and a "const void" (a modifier that resolves to void, present in the vmlinux BTF) NULL-derefs there: KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] RIP: 0010:btf_modifier_show (kernel/bpf/btf.c:2914) Call Trace: btf_type_show (kernel/bpf/btf.c:8251) btf_type_snprintf_show (kernel/bpf/btf.c:8321) bpf_snprintf_btf (kernel/trace/bpf_trace.c:1047) bpf_prog_test_run_raw_tp (net/bpf/test_run.c:829) __sys_bpf (kernel/bpf/syscall.c:4804) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) void has no size, so there is nothing to render - not even a byte length to fall back to dumping as raw hex. btf_df_show() is already the ->show for the other kinds that carry no value to print - FWD, FUNC, FUNC_PROTO, FLOAT and DECL_TAG - and emits an "" placeholder; void belongs to the same group and only lacks a show op because it has no kind_ops[] entry at all. Fall back to btf_df_show() in btf_modifier_show() when the resolved type has no show op, so a void type prints that placeholder instead of crashing; bpf_snprintf_btf() then returns the length as usual. Fixes: c4d0bfb45068 ("bpf: Add bpf_snprintf_btf helper") Signed-off-by: Jiayuan Chen --- kernel/bpf/btf.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 91b8ce77f699..6e267c4c4e1f 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -2911,7 +2911,15 @@ static void btf_modifier_show(const struct btf *btf, else t =3D btf_type_skip_modifiers(btf, type_id, NULL); =20 - btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show); + /* + * A modifier can resolve to the void type (e.g. "const void"), which + * has no show op (kind_ops[BTF_KIND_UNKN] is NULL). Print a placeholder + * instead of dereferencing NULL. + */ + if (!btf_type_ops(t)) + btf_df_show(btf, t, type_id, data, bits_offset, show); + else + btf_type_ops(t)->show(btf, t, type_id, data, bits_offset, show); } =20 static void btf_var_show(const struct btf *btf, const struct btf_type *t, --=20 2.43.0 From nobody Sat Sep 26 21:12:58 2026 Received: from mta1.migadu.com (out-215.mta1.migadu.com [95.215.58.215]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3F70F31F9A4 for ; Sun, 30 Aug 2026 07:34:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.215 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788075263; cv=none; b=mFgc6a9SJrtICph7TLuqa6weLsEmTENvvR7cHtp6V5oTn+I2xkGI+TLlq6rzZFlKczrUjj3tOqa0pGVH/zEK8KSc5+Dl00/DMzwpiz2s+y+XvrnXlqRu6sbEOv0uLPN9COj1zKQ2gCx83NcspHq2isqhn3LTN97ehgk515jD8Cc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788075263; c=relaxed/simple; bh=75UGVSqZiItz8E1acm475ZCn05iHcNlau/5M8Mc9FGc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OkHnob8L6Pz1+5RRYFu1eTUVOxRF6YtIqQf43FUYmqGdSGN4ZmNFqvVoTKgJAUH5OzOW7OgbJNi2Hggy9xXv7BlP6dthWto1gJTf76e8mWwQ3UKzLdteTeJ4DLMWmUV1NDovwbM95CcMLG5zQA4cGdrIta1lIIYNn7aFNCP6+00= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=KzgBtOSk; arc=none smtp.client-ip=95.215.58.215 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="KzgBtOSk" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=75UGVSqZiItz8E1acm475ZCn05iHcNlau/5M8Mc9FGc=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788075260; v=1; x=1788680060; b=KzgBtOSkdcOKcO+nGu8rxaBztXLYqRytNy42lBb9lhitvLB3+IRrZJN2THgsmkEnGYV8PjxR 0AuOg68QNJfrBKIS/ngiiDtfTDDOcjd4OQmBjqSvPhQGocyb4frEYI/umRAiia7kTZu/HFhVGuC EZ89SnYXh+okUAEI6Fc8QETE= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 5d6e9dbc4dc8d805; Sun, 30 Aug 2026 07:34:19 +0000 X-Mizu-Trace-ID: 5d6e9dbc4dc8d805 X-Migadu-Flow: FLOW_OUT From: Jiayuan Chen To: bpf@vger.kernel.org Cc: Jiayuan Chen , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , Shuah Khan , Mykyta Yatsenko , Alan Maguire , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf v2 3/4] selftests/bpf: Add test for key-less BTF hash map Date: Sun, 30 Aug 2026 15:30:58 +0800 Message-ID: <20260830073242.148092-4-jiayuan.chen@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260830073242.148092-1-jiayuan.chen@linux.dev> References: <20260830073242.148092-1-jiayuan.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Create a hash and an rhash map with btf_key_type_id =3D=3D 0 and expect bpf_map_create() to fail with -EINVAL; a positive control with a real key type confirms the rejection is about the key-less BTF. On an unfixed kernel the map is created, and the test pins and reads it back to walk the bpffs dump path, which reproduces the btf_type_show() NULL-deref - so running it on an unfixed kernel oopses the reading task (and panics it under panic_on_oops). Signed-off-by: Jiayuan Chen --- .../bpf/prog_tests/btf_map_keyless.c | 83 +++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_map_keyless.c diff --git a/tools/testing/selftests/bpf/prog_tests/btf_map_keyless.c b/too= ls/testing/selftests/bpf/prog_tests/btf_map_keyless.c new file mode 100644 index 000000000000..43f0bb9bd578 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/btf_map_keyless.c @@ -0,0 +1,83 @@ +// SPDX-License-Identifier: GPL-2.0 +#define _GNU_SOURCE +#include +#include + +/* + * A hash map with a key-less BTF (btf_key_type_id =3D=3D 0) used to NULL-= deref in + * btf_type_show() when dumped via bpffs. + * A fixed kernel rejects such a map at creation; on an unfixed kernel the + * pin-and-read below deliberately walks that bpffs dump path, so it doubl= es + * as a reproducer: it oopses an unfixed kernel (and panics it under + * panic_on_oops). + */ +static void check_keyless(int map_type, __u32 map_flags, int btf_fd, int v= al_id) +{ + LIBBPF_OPTS(bpf_map_create_opts, opts); + const char *path =3D "/sys/fs/bpf/keyless_map"; + __u32 key =3D 1, val =3D 0x41424344; + char buf[256]; + int map_fd; + FILE *f; + + opts.map_flags =3D map_flags; + opts.btf_fd =3D btf_fd; + opts.btf_value_type_id =3D val_id; + + /* + * Positive control: the same map with a real key type must be accepted, + * so the -EINVAL below is about the key-less BTF and not some unrelated + * rejection (e.g. an unknown map type). + */ + opts.btf_key_type_id =3D val_id; + map_fd =3D bpf_map_create(map_type, "keyed_map", 4, 4, 8, &opts); + if (!ASSERT_GE(map_fd, 0, "keyed create is accepted")) + return; + close(map_fd); + + /* A key-less BTF must be rejected. */ + opts.btf_key_type_id =3D 0; + map_fd =3D bpf_map_create(map_type, "keyless_map", 4, 4, 8, &opts); + + if (map_fd >=3D 0) { + /* Unfixed kernel: reproduce the oops via the bpffs dump path. */ + (void)bpf_map_update_elem(map_fd, &key, &val, 0); + if (bpf_obj_pin(map_fd, path) =3D=3D 0) { + f =3D fopen(path, "r"); + if (f) { + while (fgets(buf, sizeof(buf), f)) + ; + fclose(f); + } + unlink(path); + } + close(map_fd); + } + + ASSERT_EQ(map_fd, -EINVAL, "key-less create is rejected"); +} + +void test_btf_map_keyless(void) +{ + int btf_fd, val_id; + struct btf *btf; + + btf =3D btf__new_empty(); + if (!ASSERT_OK_PTR(btf, "btf__new_empty")) + return; + + val_id =3D btf__add_int(btf, "int", 4, BTF_INT_SIGNED); + if (!ASSERT_GT(val_id, 0, "btf__add_int")) + goto out; + + if (!ASSERT_OK(btf__load_into_kernel(btf), "btf__load_into_kernel")) + goto out; + btf_fd =3D btf__fd(btf); + + if (test__start_subtest("hash")) + check_keyless(BPF_MAP_TYPE_HASH, 0, btf_fd, val_id); + if (test__start_subtest("rhash")) + check_keyless(BPF_MAP_TYPE_RHASH, BPF_F_NO_PREALLOC, btf_fd, val_id); +out: + btf__free(btf); +} --=20 2.43.0 From nobody Sat Sep 26 21:12:58 2026 Received: from mta1.migadu.com (out-222.mta1.migadu.com [95.215.58.222]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A3E137C0F0 for ; Sun, 30 Aug 2026 07:34:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.222 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788075293; cv=none; b=lKgSETmoRGnPa17KpWFf8sq9nDSB+WcBQAVIhNQlflgYVgvVNJCjQFt8xXOnLjk+FhXDDcIurkCqcQwptgxRsQKy6mHXMx+dzf/KsUoN0my3vBTCN7Cu1ViNkiV6tx09tF/7wESv+q6O9SyU9Dl02teVd1xcKgn3iG8UorT3C1I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788075293; c=relaxed/simple; bh=3hNN2sJx7jce4kX+dZSg5U54CCuIoPecIBlxjnu4xRQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=vFzTBOBTR0jLeSoIj/NppzDVkkBfb51zTf2c+knGI0vf6NOaoPdJotuLyapWkkhqUz6rCG/wz8c+L+rYo6hjrkJDSpLh5AFXVuNLE51MShMU5+1WFSXWCw05UqlbRYAym3AxK9pQWc8GBEDp29WabsW9CfXkt8BIzrVe4MfVlyI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=FWw1RItb; arc=none smtp.client-ip=95.215.58.222 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="FWw1RItb" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=3hNN2sJx7jce4kX+dZSg5U54CCuIoPecIBlxjnu4xRQ=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788075287; v=1; x=1788680087; b=FWw1RItbbjz8QQfYXfgCpxOHFNnjN5y4kHK83vEEc8KATz459Qs+eU4N9lvp/yg2fi1tjaNk n9fwzlkqNFBNHXnUpnSMJlaapaXtw4cTy6SmIBC2nOlgXvTX5jouQhiOcOf1YO5RP7y4+IjrhzF HlJxbI8+6//AOOvgdhYPBZt0= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 7828805adfc406f3; Sun, 30 Aug 2026 07:34:47 +0000 X-Mizu-Trace-ID: 7828805adfc406f3 X-Migadu-Flow: FLOW_OUT From: Jiayuan Chen To: bpf@vger.kernel.org Cc: Jiayuan Chen , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Song Liu , Yonghong Song , Jiri Olsa , Emil Tsalapatis , Ihor Solodrai , Shuah Khan , Mykyta Yatsenko , Alan Maguire , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf v2 4/4] selftests/bpf: Add test for showing a void BTF type Date: Sun, 30 Aug 2026 15:30:59 +0800 Message-ID: <20260830073242.148092-5-jiayuan.chen@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260830073242.148092-1-jiayuan.chen@linux.dev> References: <20260830073242.148092-1-jiayuan.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Call bpf_snprintf_btf() with the type_id of a "const void" from the vmlinux BTF and check the rendered output is the "" placeholder. On an unfixed kernel this used to NULL-deref in btf_modifier_show(), so the test doubles as a reproducer: it oopses the task (and panics it under panic_on_oops). Signed-off-by: Jiayuan Chen --- .../selftests/bpf/prog_tests/btf_show_void.c | 57 +++++++++++++++++++ .../selftests/bpf/progs/btf_show_void.c | 22 +++++++ 2 files changed, 79 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_show_void.c create mode 100644 tools/testing/selftests/bpf/progs/btf_show_void.c diff --git a/tools/testing/selftests/bpf/prog_tests/btf_show_void.c b/tools= /testing/selftests/bpf/prog_tests/btf_show_void.c new file mode 100644 index 000000000000..546833199195 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/btf_show_void.c @@ -0,0 +1,57 @@ +// SPDX-License-Identifier: GPL-2.0 +#include +#include +#include "btf_show_void.skel.h" + +/* + * bpf_snprintf_btf() with the type_id of a "const void" (a modifier that + * resolves to void, present in the vmlinux BTF) used to NULL-deref in + * btf_modifier_show(). A fixed kernel prints the "" + * placeholder; on an unfixed kernel this oopses the task (and panics it u= nder + * panic_on_oops), so it doubles as a reproducer. + */ +void test_btf_show_void(void) +{ + LIBBPF_OPTS(bpf_test_run_opts, topts); + const struct btf_type *t; + struct btf_show_void *skel; + int i, n, cv =3D 0, err; + char ctx[16] =3D {}; + struct btf *btf; + + btf =3D btf__parse("/sys/kernel/btf/vmlinux", NULL); + if (!ASSERT_OK_PTR(btf, "btf__parse vmlinux")) + return; + + n =3D btf__type_cnt(btf); + for (i =3D 1; i < n; i++) { + t =3D btf__type_by_id(btf, i); + if (btf_kind(t) =3D=3D BTF_KIND_CONST && t->type =3D=3D 0) { + cv =3D i; + break; + } + } + if (!ASSERT_GT(cv, 0, "find const void in vmlinux BTF")) + goto out_btf; + + skel =3D btf_show_void__open(); + if (!ASSERT_OK_PTR(skel, "skel_open")) + goto out_btf; + skel->rodata->const_void_id =3D cv; + if (!ASSERT_OK(btf_show_void__load(skel), "skel_load")) + goto out_skel; + + topts.ctx_in =3D ctx; + topts.ctx_size_in =3D sizeof(ctx); + err =3D bpf_prog_test_run_opts(bpf_program__fd(skel->progs.dump_const_voi= d), + &topts); + if (!ASSERT_OK(err, "test_run")) + goto out_skel; + + ASSERT_EQ(skel->bss->ret, sizeof("") - 1, "ret"); + ASSERT_STREQ(skel->bss->out, "", "placeholder"); +out_skel: + btf_show_void__destroy(skel); +out_btf: + btf__free(btf); +} diff --git a/tools/testing/selftests/bpf/progs/btf_show_void.c b/tools/test= ing/selftests/bpf/progs/btf_show_void.c new file mode 100644 index 000000000000..9fabd7372f89 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/btf_show_void.c @@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0 +#include "btf_ptr.h" +#include + +const volatile __u32 const_void_id; +char out[64]; +long ret; + +SEC("raw_tp/sys_enter") +int dump_const_void(void *ctx) +{ + struct btf_ptr ptr =3D { + .ptr =3D ctx, + .type_id =3D const_void_id, + .flags =3D 0, + }; + + ret =3D bpf_snprintf_btf(out, sizeof(out), &ptr, sizeof(ptr), 0); + return 0; +} + +char _license[] SEC("license") =3D "GPL"; --=20 2.43.0