github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bpf: Propagate btf_add_type() errors in btf_check_all_metas()

Browse Source 
btf_check_all_metas() ignores the return value of btf_add_type(), so a
type that could not be registered is silently dropped while the loop
keeps walking over the type section.

Both failure modes are reachable:

  - -E2BIG.  Once the types array reaches its capacity (BTF_MAX_TYPE),
    every following btf_add_type() fails the same way, so
    btf_check_all_metas() still returns 0 and the BTF object is created
    with btf->nr_types capped while hdr->type_len claims more records.

  - -ENOMEM.  btf->nr_types is not incremented and the array is not
    grown, so the next type is recorded at the slot of the dropped one
    and btf->types[] stays off by one with respect to the type ids for
    all remaining types.  btf_type_by_id() then returns the wrong type
    for those ids for the whole lifetime of the object, and the last
    type is silently left unresolved.

Propagate the error so that the object is rejected instead.

Fixes: 69b693f0ae ("bpf: btf: Introduce BPF Type Format (BTF)")
Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Mahe Tardy <mahe.tardy@gmail.com>
Acked-by: Alan Maguire <almagui@kernel.org>
Link: https://patch.msgid.link/20261022064727.747304-1-yangfeng59949@163.com
This commit is contained in:
Feng Yang 2026-10-22 14:47:27 +08:00 committed by Alexei Starovoitov
parent 02da62c2f8
commit fb2b27d214
No known key found for this signature in database
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
kernel/bpf/btf.c
View File

@ -5871,6 +5871,7 @@ static int btf_check_all_metas(struct btf_verifier_env *env)
struct btf *btf = env->btf;
struct btf_header *hdr;
void *cur, *end;
int err;
hdr = &btf->hdr;
cur = btf->nohdr_data + hdr->type_off;
@ -5885,7 +5886,10 @@ static int btf_check_all_metas(struct btf_verifier_env *env)
if (meta_size < 0)
return meta_size;
btf_add_type(env, t);
err = btf_add_type(env, t);
if (err)
return err;
cur += meta_size;
env->log_type_id++;
}