From nobody Tue Sep 29 08:30:22 2026 Received: from mail-lj1-f172.google.com (mail-lj1-f172.google.com [209.85.208.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C55682F616A for ; Mon, 10 Aug 2026 15:36:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.208.172 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786376172; cv=pass; b=fT4ahM0M0AGB0W7Oshn4d8r+xtg7GQLGVBri7jEvdbQMbKHMwhP+r0rcwN0bSfpw/v4J4htquVVS0Hle4vZPl46tAqeifC1xvEYPsUlWxkFUlelOwoBsl5gOAZyWQNyEtmsUEpUP4FM89nOvfWeeCDKHrimgsfSfGjo0nGvPb9w= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786376172; c=relaxed/simple; bh=n8olFxv2/B8lZ96dx6n2x6SHUcA86fdHDqLKScaviFM=; h=MIME-Version:From:Date:Message-ID:Subject:To:Cc:Content-Type; b=KMHn9UcUITg5QEQcsoenJ5E2XR5XGEuMKeoHByO0BAEpVODgwnEquT7v0JL5Vz6djR8q9j6x7fIjK1QySiTIKqFB40tWzWHX53DExIimys8xGeOQ2DdD4hG+QtTp2V6VP04EissqrypO1wBVtogBbbK26ZGB+RMQZDd8NyH6CTo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IqzPMldF; arc=pass smtp.client-ip=209.85.208.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IqzPMldF" Received: by mail-lj1-f172.google.com with SMTP id 38308e7fff4ca-39c9a3acd40so13699051fa.3 for ; Mon, 10 Aug 2026 08:36:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1786376169; cv=none; d=google.com; s=arc-20260327; b=Ns7Z22VzOBVbEw2kmP/6s+H4I+e7EvJhR/mtDput0DrV09eHdM+7qWIRMfHfGOb7CP 5l7HnR5OdOXivE5x0mNpzLAU+OLglbrA9qy0fmuYs7deIpiYxuKMQJ35T/2felMp/nFy D/kKVcAvnPDoNgO7MD2ERyqLg+Rh6fxMlrcYe6tlJcIpdQYyolT7fmXc2t8teLdeGaUs xZm0ROPlNRLYv/CjOcOxWAclTz3F+lsFetnHVrUVe4WiflLOifW1v7HhvbIHXzQ+bSkV iNoxuXb9PSa+cklXauZXB7p6f5wn6PDCKuICVi4oqc7JQr0Q2tsvnUTG6SXOJdyS2bKY FnJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:mime-version:dkim-signature; bh=YFVCchQzBB9Xntjm9ZDcdgmlYOmjw3/Zstjs0JA74WM=; fh=SX+xaLNuneNwWbn2TWEily53XRZsE9TIHPbFrm2Ymvc=; b=nHovtxF7vlD9YlSPdyhnNu+T1FCXMgptyDx+BwmxNce72plZBKbnQNjRiCTjFYXmQt RD+fe8NeDquhiXiE8VJ0z1a/f576s2fWW5iP2ipvXsf/3Kl4aoOdWIg5eifMFZkPvz+J o6yB+ze5vW+buo8zZ7C2mSuL2Hu6q24Sw+OIGJw//2lEfJBvTXdl3reBgpEItWZFW0Vp nYHgeL+qDaEDnV6DU95J1PseIvO9ihh/2/0vdoCWhD+gjP49WqTAlppMNewjvRCu8ty9 pNEjQpDVXA1CXPLjADHm6JF7ccNjIXrR65utKYAX4gNJeOs2ktXBCnneUo9RF5/Uqd0q HcjQ==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786376169; x=1786980969; darn=vger.kernel.org; h=content-type:cc:to:subject:message-id:date:from:mime-version:from :to:cc:subject:date:message-id:reply-to:content-type; bh=YFVCchQzBB9Xntjm9ZDcdgmlYOmjw3/Zstjs0JA74WM=; b=IqzPMldFTXkjLCIn34KnAkZHuiXX+JARmXq6SujXBpGUMWHcLwY+X/gzsAkjUKxbeT 7qv5ytrgVb1tQefxKYT/UkeiDBHaPKTjrB30i2NAyigtDTRAjW91SQV4KXiuE/5BemBt MGe7Z6O/wetrFZIiK59xfSm37R8T1Qp0EPu6GX+flnanCnLJUhFYcNLQbmLBak18zQip kKzKjadUogSxnn3gcLf0VolM877pStwPUmDiln050XnKm5zC4VB97Pbh0wB8CNXuWxxT 07AYcxvXiUxeSphx/+QNQnm6x91oX1pCKUG2h4+qL8qQwH3yXqtt8y4i3Xh6/tVl4naq S+5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786376169; x=1786980969; h=content-type:cc:to:subject:message-id:date:from:mime-version :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=YFVCchQzBB9Xntjm9ZDcdgmlYOmjw3/Zstjs0JA74WM=; b=hjgrakoOr8TXzaLCX+kfRKC2m0SXOmojjRYZkgU2sSSfi2m4NlIA/0Yni2IF7haByl X3HRzbKhcz6yQhlXuexnQBt35xrj2Vv8HJHNJ9yJf9lP9eB5pzK6E/wZIXTV6B6E6vpr /k+OjwbWdVXVqecE5a2DZMHUPRBSlk6tG5bB1GOlQJvjrfYXiY90IdQJn0SOPUSiC0dM 9791PgPn875ztkTVI0b9wQYJ8dbQV2KWxXmyALig2hBFle+BoKZP4RA6Tp0c2yVhLmUl UHzcMV/4itUhEVoqfA3acIERgje/e2BgVTzEaAfDZG2q04rly2NK5sT4V7CMylRjylgL UNSA== X-Forwarded-Encrypted: i=1; AHgh+RrBeui65lTCdKHas5Nw5jILoQxOPFimNsPCtPFAMdTtBNjC/iF32f83ZbNdp+PEx+BX59v8dzF3IK/8vkc=@vger.kernel.org X-Gm-Message-State: AOJu0Yz+0kLOMDnUyqGFFe/oE5pIc5Fca+XbJCeOnsA9U+5c3T1FBx1j PtyaZ57yT2WE7og6v4HTsLPZBw2xnYASJLbHKcL8sgz4uPeZ8FKlzapEQqnHLwyZk3W0OB5gP4R yZBT2ck9s8cu5W9MoG4iHLLFH3et7E8wfaTtpFfw= X-Gm-Gg: AR+sD10ATsexppAqtaKZ8pjzELR3ihJvmXaogzrJDwloZCASyujRTxKXzNH8gSmJYY0 qsBf7RJgXU118Dwhdyot/Cb8Ymg4PBNXsXeP6T/R7WPFg9GdV0FLN/aAg8BpXNAEENebxhAgRWu 7YNZQAxUGZe/nacec2Qzzp5t7M01KHfNHWVIEKHJ07lJB9QeHP8ufvXsqGKYQAmnk43vpFmE7dZ GdWTfiNnmZZgWnlOKwPNTW4016iKQV9ri2o6ZH+uRPFf4DIpwuGf7sbXoFGZor353uKtUx4dFEC Ng6EJMSBg1v/ABjrePmqlk6fkK0YodZ40q4/DlToQme0lkZsoHFwGI9cNCXN7V2ToahaPEKiupW u4tn5G9OrOTdXwc8CFzaypJuN64ItuOGGPpajR96WmoewUCQE9HhHDeh01QC6CwXhcufdpg== X-Received: by 2002:a2e:be28:0:b0:39e:eb8c:351a with SMTP id 38308e7fff4ca-39fbb22cd47mr48291721fa.27.1786376168628; Mon, 10 Aug 2026 08:36:08 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Darren Carreras Date: Mon, 10 Aug 2026 11:35:57 -0400 X-Gm-Features: AUfX_mx21hSlWZJQWB17rjBHQJCz4dKq83gmqxnzz7aX-nPkDhDh0mpCrqF0ZKw Message-ID: Subject: [PATCH bpf-next] libbpf: avoid overflow in BTF.ext bounds check To: bpf@vger.kernel.org Cc: andrii@kernel.org, eddyz87@gmail.com, ihor.solodrai@linux.dev, ast@kernel.org, daniel@iogearbox.net, memxor@gmail.com, martin.lau@linux.dev, song@kernel.org, yonghong.song@linux.dev, jolsa@kernel.org, shuah@kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From 0ee0da46079d4e9453afe2b28acdaadc0f011042 Mon Sep 17 00:00:00 2001 From: Darren Carreras Date: Mon, 10 Aug 2026 11:20:13 -0400 Subject: [PATCH] libbpf: avoid overflow in BTF.ext bounds check An invalid BTF.ext subsection length can wrap the pointer addition used by btf_ext_parse_sec_info() on 32-bit builds. The wrapped pointer passes the bounds check and parsing then reads beyond the copied BTF.ext data. Validate the offset and length with subtraction before forming the section pointer. Add a selftest using an overflowing func_info_len. Fixes: cf579164e9ea ("libbpf: Support BTF.ext loading and output in either endianness") Closes: https://issues.oss-fuzz.com/issues/477315119 Signed-off-by: Darren Carreras --- tools/lib/bpf/btf.c | 13 +++++----- .../selftests/bpf/prog_tests/test_btf_ext.c | 24 +++++++++++++++++++ 2 files changed, 31 insertions(+), 6 deletions(-) diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c index 8417de92d..744f33e2a 100644 --- a/tools/lib/bpf/btf.c +++ b/tools/lib/bpf/btf.c @@ -3364,7 +3364,7 @@ static int btf_ext_parse_sec_info(struct btf_ext *btf= _ext, { const struct btf_ext_info_sec *sinfo; struct btf_ext_info *ext_info; - __u32 info_left, record_size; + __u32 data_left, info_left, record_size; size_t sec_cnt =3D 0; void *info; @@ -3377,16 +3377,17 @@ static int btf_ext_parse_sec_info(struct btf_ext *btf_ext, return -EINVAL; } - /* The start of the info sec (including the __u32 record_size). */ - info =3D btf_ext->data + btf_ext->hdr->hdr_len + ext_sec->off; - info_left =3D ext_sec->len; - - if (btf_ext->data + btf_ext->data_size < info + ext_sec->len) { + data_left =3D btf_ext->data_size - btf_ext->hdr->hdr_len; + if (ext_sec->off > data_left || ext_sec->len > data_left - ext_sec->off) { pr_debug("%s section (off:%u len:%u) is beyond the end of the ELF section .BTF.ext\n", ext_sec->desc, ext_sec->off, ext_sec->len); return -EINVAL; } + /* The start of the info sec (including the __u32 record_size). */ + info =3D btf_ext->data + btf_ext->hdr->hdr_len + ext_sec->off; + info_left =3D ext_sec->len; + /* At least a record size */ if (info_left < sizeof(__u32)) { pr_debug(".BTF.ext %s record size not found\n", ext_sec->desc); diff --git a/tools/testing/selftests/bpf/prog_tests/test_btf_ext.c b/tools/testing/selftests/bpf/prog_tests/test_btf_ext.c index 7d1b478c9..77db87dab 100644 --- a/tools/testing/selftests/bpf/prog_tests/test_btf_ext.c +++ b/tools/testing/selftests/bpf/prog_tests/test_btf_ext.c @@ -1,9 +1,31 @@ // SPDX-License-Identifier: GPL-2.0 /* Copyright (c) 2025 Meta Platforms Inc. */ #include +#include "bpf/libbpf_internal.h" #include "test_btf_ext.skel.h" #include "btf_helpers.h" +static void subtest_invalid_info_len(void) +{ + struct { + struct btf_ext_header hdr; + __u32 record_size; + } raw =3D { + .hdr =3D { + .magic =3D BTF_MAGIC, + .version =3D BTF_VERSION, + .hdr_len =3D sizeof(raw.hdr), + .func_info_len =3D UINT32_MAX - 7, + }, + .record_size =3D sizeof(struct bpf_func_info_min), + }; + struct btf_ext *btf_ext; + + btf_ext =3D btf_ext__new((void *)&raw, sizeof(raw)); + if (!ASSERT_ERR_PTR(btf_ext, "invalid_info_len")) + btf_ext__free(btf_ext); +} + static void subtest_line_func_info(void) { struct test_btf_ext *skel; @@ -59,6 +81,8 @@ static void subtest_line_func_info(void) void test_btf_ext(void) { + if (test__start_subtest("invalid_info_len")) + subtest_invalid_info_len(); if (test__start_subtest("line_func_info")) subtest_line_func_info(); } --=20 2.50.1 (Apple Git-155)