From f6b6c87262da0ce58e9f24883cf6f7b2a3f2c338 Mon Sep 17 00:00:00 2001 From: Alan Maguire Date: Mon, 12 Oct 2026 15:06:38 +0100 Subject: [PATCH 1/3] btf: Fix size/vlen validation for BTF_KIND_LOC_PARAM Validation logic allowed a BTF_KIND_LOC_PARAM with size <= 4 and vlen == 2, an inconsistent representation. Fixes: a3df11403e8c8 ("bpf: Verify BTF_KIND_LOC_PARAM vlen, flags") Suggested-by: Alexei Starovoitov Signed-off-by: Alan Maguire Signed-off-by: Alexei Starovoitov Link: https://patch.msgid.link/20261012140640.2932195-2-alan.maguire@oracle.com --- kernel/bpf/btf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index b09c04ccdc6d..64c78434fa05 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -4827,12 +4827,12 @@ static s32 btf_loc_param_check_meta(struct btf_verifier_env *env, case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_SIGNED: case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR: case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR | BTF_LOC_PARAM_SIGNED: - if (vlen > 2) + if (vlen < 1 || vlen > 2) + goto invalid_vlen; + if (!size || size > sizeof(__u64)) goto invalid_vlen; /* Ensure size/vlen are consistent */ - if (size > sizeof(__u32) && vlen != 2) - goto invalid_vlen; - if (size > sizeof(__u64)) + if (vlen != (size > sizeof(__u32) ? 2 : 1)) goto invalid_vlen; break; case BTF_LOC_PARAM_REG: From 35369ca4954c65f6423d02fad624997d72beec30 Mon Sep 17 00:00:00 2001 From: Alan Maguire Date: Mon, 12 Oct 2026 15:06:39 +0100 Subject: [PATCH 2/3] selftests/bpf: Fix btf_inline to use .text section as base Relative addresses in LOCSEC are relative to the associated ELF section for the LOCSEC "inline
"; in the case of this test, it is ".text". Fix the test to compute the address via the section base rather than the overall module base address. Since addresses in BTF inline LOC_PARAMs can be module base-relative, do not remove the module base calcuation function. Fixes: 400f0881c912 ("selftests/bpf: Add a test verifying inline information") Signed-off-by: Alan Maguire Signed-off-by: Alexei Starovoitov Link: https://patch.msgid.link/20261012140640.2932195-3-alan.maguire@oracle.com --- .../selftests/bpf/prog_tests/btf_inline.c | 5 +++-- tools/testing/selftests/bpf/trace_helpers.c | 19 +++++++++++++++++++ tools/testing/selftests/bpf/trace_helpers.h | 1 + 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/bpf/prog_tests/btf_inline.c b/tools/testing/selftests/bpf/prog_tests/btf_inline.c index d88fab6429b1..e630e5f0f5fa 100644 --- a/tools/testing/selftests/bpf/prog_tests/btf_inline.c +++ b/tools/testing/selftests/bpf/prog_tests/btf_inline.c @@ -32,7 +32,8 @@ void test_btf_inline(void) return; } - base_addr = module_get_base_addr("bpf_testmod"); + /* LOCSEC offsets are relative to the ELF section base. */ + base_addr = module_get_base_addr_sec("bpf_testmod", ".text"); if (!ASSERT_NEQ(base_addr, 0, "base_addr_nonzero")) return; @@ -41,7 +42,7 @@ void test_btf_inline(void) return; if (!ASSERT_NEQ(caller_addr, 0, "caller_addr_nonzero")) return; - if (!ASSERT_GT(caller_addr, base_addr, "caller_addr_gt_base_addr")) + if (!ASSERT_GE(caller_addr, base_addr, "caller_addr_ge_base_addr")) return; caller_addr -= base_addr; diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c index f3a1d627699d..6d7a4b8c4ab8 100644 --- a/tools/testing/selftests/bpf/trace_helpers.c +++ b/tools/testing/selftests/bpf/trace_helpers.c @@ -264,6 +264,25 @@ unsigned long long module_get_base_addr(const char *module) return base_addr; } +unsigned long long module_get_base_addr_sec(const char *module, const char *sec) +{ + unsigned long long addr = 0; + char *path; + FILE *f; + + if (asprintf(&path, "/sys/module/%s/sections/%s", module, sec) < 0) + return 0; + f = fopen(path, "r"); + free(path); + if (!f) + return 0; + + if (fscanf(f, "%llx", &addr) != 1) + addr = 0; + fclose(f); + return addr; +} + #ifdef PROCMAP_QUERY int env_verbosity __weak = 0; diff --git a/tools/testing/selftests/bpf/trace_helpers.h b/tools/testing/selftests/bpf/trace_helpers.h index eb0d0d9804d6..0f8d99746084 100644 --- a/tools/testing/selftests/bpf/trace_helpers.h +++ b/tools/testing/selftests/bpf/trace_helpers.h @@ -39,6 +39,7 @@ int load_kallsyms(void); struct ksym *ksym_search(long key); long ksym_get_addr(const char *name); unsigned long long module_get_base_addr(const char *module); +unsigned long long module_get_base_addr_sec(const char *module, const char *sec); struct ksyms *load_kallsyms_local(void); struct ksym *ksym_search_local(struct ksyms *ksyms, long key); From add69af5068df37c4c6e2808e9bd1332138f1180 Mon Sep 17 00:00:00 2001 From: Alan Maguire Date: Mon, 12 Oct 2026 15:06:40 +0100 Subject: [PATCH 3/3] selftests/bpf: Enable CONFIG_DEBUG_INFO_BTF_INLINE for CI Ensure we add inline info to BTF for testing. Suggested-by: Alexei Starovoitov Signed-off-by: Alan Maguire Signed-off-by: Alexei Starovoitov Link: https://patch.msgid.link/20261012140640.2932195-4-alan.maguire@oracle.com --- tools/testing/selftests/bpf/config | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config index 2b883b388f90..d1a19fb125dd 100644 --- a/tools/testing/selftests/bpf/config +++ b/tools/testing/selftests/bpf/config @@ -23,6 +23,7 @@ CONFIG_CRYPTO_ECB=y CONFIG_CRYPTO_AES=y CONFIG_DEBUG_INFO=y CONFIG_DEBUG_INFO_BTF=y +CONFIG_DEBUG_INFO_BTF_INLINE=y CONFIG_DEBUG_INFO_DWARF4=y CONFIG_DMABUF_HEAPS=y CONFIG_DMABUF_HEAPS_SYSTEM=y