From nobody Wed Sep 30 10:03:20 2026 Received: from mail-lj1-f169.google.com (mail-lj1-f169.google.com [209.85.208.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4B366416CFA for ; Mon, 10 Aug 2026 15:26:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.208.169 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786375615; cv=pass; b=kS267G5Dm9tzm54je5hWkm6P6m6C8OBYLnhdNusT3m4J5etrnO8pXK56pxMGBNMp3TjYEmlh0OPKz+rACcVDgabQkX/aaRYS+4McCRivzfe682KRSYn0WKwOwy/G0KA/C1D1om6hWee9O0whVdP+0cADRHXtK06sxN23kLROanw= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786375615; c=relaxed/simple; bh=+K3xQwVsU4I25WsS9rN34aMOudq9HpZIatSbAmd00XA=; h=MIME-Version:From:Date:Message-ID:Subject:To:Cc:Content-Type; b=J2HgZRMdfl10QLzR7HLXRmlZvm/QtBdM1o8bfGwpxXSllJ4BMw+1Ay96NigJIDMQHqJYRmmZ6UcAc2xj0KygXHwg/000arIzblSEwIanxNUz/0eE8pTRehtQYIXCCgQcmOUceEXYX+KPD4ng7UHnpetjbK146th+bQ4s1JETmp8= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=m+DTLIdm; arc=pass smtp.client-ip=209.85.208.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="m+DTLIdm" Received: by mail-lj1-f169.google.com with SMTP id 38308e7fff4ca-39c953950dfso14377801fa.1 for ; Mon, 10 Aug 2026 08:26:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1786375612; cv=none; d=google.com; s=arc-20260327; b=pYUhQHjjilxixZxKxJUHp8K2fnZHLNU9irqLIS2TfOngDrIg3jFwSoeBgqJExNXum9 8vqu1D6MOSCmT7ap8Scynfmd0NSTIMpTC1Qa05fwMMKc7qq2mAjE0s14KHPhMaQid1ig arTq2egLHxFOZHNQhvvSVYrXADdJo2SUPJ3hQoevgPaXt1LSDod3+orsbKgtik+7QzpB bmxCe+93JAlLitJsGiUbfS+PIXBjlKNlnHMb7kVoO4VtHpu71EmuJCCfLYWBSdc1N5Ep jp8C2sHMdqrcoJnpLK8huSge2h6XxkS/1eQEsk/IJ7qNfmtDkY4RcmPAbcKJN+WPQOQf lREg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:mime-version:dkim-signature; bh=v7Xq9mPRy28VF7pzeQHOI5qX2E+YKQ91Mag0+Ocdsy8=; fh=LDjhBtJEOSPaXNVNpKHKLFySNOnBFA+9NsrrPowP1T0=; b=eDPsd33YOW5IUm0S0ZfvpKuksqlbZS3an+SyJ+gTP08MxXREbf94cSGv8T0ccg6KUy cVRZlWhSCev99K1CPryLV1dHbE7/tknHcU0kdqAw6yVd6jp/rzVKcTnpkv9LzTesxRTY gFBG0jM3dbYtaYqUbevs8SMdWGb05J7oihn4Hme18+HZfxynZdFPNsZVJtMDr9ymmQLv CWw9gjhuFs13d2dO5vchuiXs7VEGrcPfgBACCYPQgEuquarDkBFb9xOeKbRYGI3ucJeG WGl3ujTMvXJAd6Zm2lFwHe9UPoepw3Dyce2HqcbrCVzZ9YTDRa3W2AkcZxk/5CfoSmP+ EvOQ==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786375612; x=1786980412; darn=vger.kernel.org; h=content-type:cc:to:subject:message-id:date:from:mime-version:from :to:cc:subject:date:message-id:reply-to:content-type; bh=v7Xq9mPRy28VF7pzeQHOI5qX2E+YKQ91Mag0+Ocdsy8=; b=m+DTLIdmyltAbTgSK6Oh8LgH83QVfn7pNusbOrUWZaFd9rBJQP04bQIPejp2IX9k7S 2BP2vy+LhHMiEQokWF+pnyAbNKFbqdJ4KlkAhyntKmZX9K2UumIEN3oI13ZeyRoy650L B8dbeSTpmUpj20yWC/t6Vs6obHcC/VhzG9263wfLri3Q+ZFLtqh0YRqoyLPHU6o7uCGY 3kUpobk+k9/tesO92oGjUnIr72vvzUvTtMAmW2jXlTjWCY4roL8JVSLjmXuOkSHK4fpE suwUnb7S2/QJe5pqDa7yDzXv1szOjQhH+Dc/zyDGFsuuDqB4cx2i2QkfB1iImpy+OxNl +2wA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786375612; x=1786980412; h=content-type:cc:to:subject:message-id:date:from:mime-version :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=v7Xq9mPRy28VF7pzeQHOI5qX2E+YKQ91Mag0+Ocdsy8=; b=WfwRJ5iTOL1Xl0RD6OaGuly564GAz/eRJvNHnP5596rsA6iorKc3mTYStpkWN/+Ebg 9s0lgENhgn3DWnrYz/9bY/hI1sIHL7HyzONQxPuXNPTgVRrZz42Dmoo5brnXDlmKjzR7 LIx0uVhRn8eNaw1t3VGSAiSUa9xiR5Yq5po1ShkeYJAbXtmqVXsXVegy/Y2XmVNZx8Fy r9ktZTYK6PTdoTGPF1URajw4xFUKp1fjf8ZWdVDxnTjQU2A4ABAjj8HpNLo4oDaTvyLU 1PpHRhE9+opiUbq4n0O4yTvItb3vBtt0T6FyK0JkVQj34iYTOoxYwF8iP3aiErY+Rays +l6g== X-Forwarded-Encrypted: i=1; AHgh+RpbQIE16uo7Gx3ViTjvg5Yi+v1lbD7Q8nj2IhCQowJZ7aVz3MI251qtfZdD5nrh1uc1dc6igHpcfxjjgtY=@vger.kernel.org X-Gm-Message-State: AOJu0YyidTzU2mFTKBawJstobnSnsGICLj74igvEU/WfVUYK4DFV1nAh J2HSaBoYF2DJFk2aqSTsHTmGGZvKO4tu7oGUvsaNdU6VuvqdJ+3nALBLH5UsAC8IsizwlkcyQ4b c4yaynS0YKBU20+dimDzYYQ2AGrbL5uM= X-Gm-Gg: AR+sD12mqkwbWRSRrhB+A5dA/mVXJAyAPN/+TZbf28hTaqPCKmz8FLPZ5TEwF6b/vuC ayE/LAskdx/NPh5AHhvRNlXHEAhLHarImCMMLuoA2zESIaI2CxHM+0jmFJXbqKDSW0l5104DJiU ENfCWWugAswAlyFB2gINSIGKEVBq/ptg1Szp/cNrIpfHi9q70pIiPht1GqChQ4tus27R8IShYJN 1XhtCnzrQQtczx4QYMgvXTsifTxLJLOYI41veQBg3JE2VKPTPrknVqAlpvDjCL8ooLEqsKxC0k/ 2Unx+B9xT+bcXuMbYVhhMJTyVXCydRBqOHAqeEx3Z1TSkRj8aQcSdeELNd+AhiUlFqgOFrlFhmv eZGoSSNFeeW+ILYODg9KbzdfO+m0sW3zSlUmaW2/SzgSlx62WzlHOd2KK5bM= X-Received: by 2002:a2e:a99f:0:b0:39a:ea4e:736a with SMTP id 38308e7fff4ca-39fbb2399e6mr51122981fa.28.1786375612023; Mon, 10 Aug 2026 08:26:52 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Darren Carreras Date: Mon, 10 Aug 2026 11:26:40 -0400 X-Gm-Features: AUfX_mxx0jT2wYKaLW1ScYYLzHltfU6a9p2yToSyhWc3aGXo6p15FIZz6P6iQFg Message-ID: Subject: [PATCH bpf-next] libbpf: avoid overflow in BTF.ext bounds check To: bpf@vger.kernel.org Cc: andrii@kernel.org, eddyz87@gmail.com, ihor.solodrai@linux.dev, ast@kernel.org, daniel@iogearbox.net, memxor@gmail.com, martin.lau@linux.dev, song@kernel.org, yonghong.song@linux.dev, jolsa@kernel.org, shuah@kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From 0ee0da46079d4e9453afe2b28acdaadc0f011042 Mon Sep 17 00:00:00 2001 From: Darren Carreras Date: Mon, 10 Aug 2026 11:20:13 -0400 Subject: [PATCH] libbpf: avoid overflow in BTF.ext bounds check An invalid BTF.ext subsection length can wrap the pointer addition used by btf_ext_parse_sec_info() on 32-bit builds. The wrapped pointer passes the bounds check and parsing then reads beyond the copied BTF.ext data. Validate the offset and length with subtraction before forming the section pointer. Add a selftest using an overflowing func_info_len. Fixes: cf579164e9ea ("libbpf: Support BTF.ext loading and output in either endianness") Closes: https://issues.oss-fuzz.com/issues/477315119 Signed-off-by: Darren Carreras --- tools/lib/bpf/btf.c. | 13 +++++----- .../selftests/bpf/prog_tests/test_btf_ext.c. | 24 +++++++++++++++++++ 2 files changed, 31 insertions(+), 6 deletions(-) diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c index 8417de92d..744f33e2a 100644 --- a/tools/lib/bpf/btf.c +++ b/tools/lib/bpf/btf.c @@ -3364,7 +3364,7 @@ static