Re: [PATCH v14 bpf-next 02/10] libbpf: Support layout section handling in BTF

On Wed, Mar 18, 2026 at 7:45 AM <[email protected]> wrote:
>
> > diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
> > index 40becc9643688..37a3b317cb2f4 100644
> > --- a/tools/lib/bpf/btf.c
> > +++ b/tools/lib/bpf/btf.c
>
> [ ... ]
>
> > -static void btf_bswap_hdr(struct btf_header *h)
> > +static void btf_bswap_hdr(struct btf_header *h, __u32 hdr_len)
> >  {
> >       h->magic = bswap_16(h->magic);
> >       h->hdr_len = bswap_32(h->hdr_len);
> > @@ -224,66 +246,113 @@ static void btf_bswap_hdr(struct btf_header *h)
> >       h->type_len = bswap_32(h->type_len);
> >       h->str_off = bswap_32(h->str_off);
> >       h->str_len = bswap_32(h->str_len);
> > +     /* May be operating on raw data with hdr_len that does not include below fields */
> > +     if (hdr_len >= sizeof(struct btf_header)) {
> > +             h->layout_off = bswap_32(h->layout_off);
> > +             h->layout_len = bswap_32(h->layout_len);
> > +     }
> >  }
> >
> >  static int btf_parse_hdr(struct btf *btf)
> >  {
> > -     struct btf_header *hdr = btf->hdr;
> > -     __u32 meta_left;
> > +     struct btf_header *hdr = btf->raw_data;
> > +     __u32 hdr_len, meta_left;
> >
> > -     if (btf->raw_size < sizeof(struct btf_header)) {
> > +     if (btf->raw_size < offsetofend(struct btf_header, str_len)) {
> >               pr_debug("BTF header not found\n");
> >               return -EINVAL;
> >       }
> >
> > +     hdr_len = hdr->hdr_len;
> > +
> >       if (hdr->magic == bswap_16(BTF_MAGIC)) {
> >               btf->swapped_endian = true;
> > -             if (bswap_32(hdr->hdr_len) != sizeof(struct btf_header)) {
> > +             hdr_len = bswap_32(hdr->hdr_len);
> > +             if (hdr_len < offsetofend(struct btf_header, str_len)) {
> >                       pr_warn("Can't load BTF with non-native endianness due to unsupported header length %u\n",
> > -                             bswap_32(hdr->hdr_len));
> > +                             hdr_len);
> >                       return -ENOTSUP;
> >               }
> > -             btf_bswap_hdr(hdr);
> > +             btf_bswap_hdr(hdr, hdr_len);
>
> Could btf_bswap_hdr() access memory beyond the raw_data buffer here?

Alan,

before you respin please look through other bugs that gemini found:
https://sashiko.dev/#/patchset/20260318132927.1142388-1-alan.maguire%40oracle.com

pw-bot: cr