Re: [PATCH v10 bpf-next 06/10] btf: support kernel parsing of BTF with layout info

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 4872d2a6c42d..e5a9774907fe 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c

[ ... ]

> +static int btf_parse_layout_sec(struct btf_verifier_env *env)
> +{
> +	const struct btf_header *hdr = &env->btf->hdr;
> +	struct btf *btf = env->btf;
> +	void *start, *end;
> +
> +	if (hdr->hdr_len < sizeof(struct btf_header) ||
> +	    hdr->layout_len == 0)
> +		return 0;
> +
> +	/* Llayout section must align to 4 bytes */
> +	if (hdr->layout_off & (sizeof(u32) - 1)) {
> +		btf_verifier_log(env, "Unaligned layout_off");
> +		return -EINVAL;
> +	}
> +	start = btf->nohdr_data + hdr->layout_off;
> +	end = start + hdr->layout_len;
> +
> +	if (hdr->layout_len < sizeof(struct btf_layout)) {
> +		btf_verifier_log(env, "Layout section is too small");
> +		return -EINVAL;
> +	}

Should layout_len also be checked for alignment to
sizeof(struct btf_layout)?  The libbpf counterpart in
btf_parse_layout_sec() validates this:

    if (btf->hdr.layout_len % sizeof(struct btf_layout) != 0) {
        pr_debug("Invalid BTF kind layout section\n");
        return -EINVAL;
    }

Without this check the kernel accepts a layout section with a
partial trailing entry (e.g. layout_len = 5 passes the >= 4
check here).  The commit message notes "the kernel must be
strict in what it accepts," so matching the libbpf validation
seems appropriate.

> +	if (end > btf->data + btf->data_size) {
> +		btf_verifier_log(env, "Layout section is too big");
> +		return -EINVAL;
> +	}
> +	btf->layout = start;
> +
> +	return 0;
> +}


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/22482435858

AI-authorship-score: low
AI-authorship-explanation: Part of a v10 series with extensive mailing list discussion, demonstrates deep kernel BTF expertise, and the Llayout typo is a characteristically human error.
issues-found: 1
issue-severity-score: low
issue-severity-explanation: Missing layout_len modular validation allows the kernel to accept malformed BTF that libbpf rejects, but no kernel code currently iterates over layout entries so the impact is limited to inconsistent validation.