From: Feng Yang <yangfeng@kylinos.cn> mainline inclusion from mainline-v7.4-rc1 commit fb2b27d214c3b88d926a303267dd83cfdb428b13 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- btf_check_all_metas() ignores the return value of btf_add_type(), so a type that could not be registered is silently dropped while the loop keeps walking over the type section. Both failure modes are reachable: - -E2BIG. Once the types array reaches its capacity (BTF_MAX_TYPE), every following btf_add_type() fails the same way, so btf_check_all_metas() still returns 0 and the BTF object is created with btf->nr_types capped while hdr->type_len claims more records. - -ENOMEM. btf->nr_types is not incremented and the array is not grown, so the next type is recorded at the slot of the dropped one and btf->types[] stays off by one with respect to the type ids for all remaining types. btf_type_by_id() then returns the wrong type for those ids for the whole lifetime of the object, and the last type is silently left unresolved. Propagate the error so that the object is rejected instead. Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)") Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Mahe Tardy <mahe.tardy@gmail.com> Acked-by: Alan Maguire <almagui@kernel.org> Link: https://patch.msgid.link/20261022064727.747304-1-yangfeng59949@163.com Signed-off-by: Pu Lehui <pulehui@huawei.com> --- kernel/bpf/btf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 558ef5930a7d..66ee3dc4d040 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -5063,6 +5063,7 @@ static int btf_check_all_metas(struct btf_verifier_env *env) struct btf *btf = env->btf; struct btf_header *hdr; void *cur, *end; + int err; hdr = &btf->hdr; cur = btf->nohdr_data + hdr->type_off; @@ -5077,7 +5078,10 @@ static int btf_check_all_metas(struct btf_verifier_env *env) if (meta_size < 0) return meta_size; - btf_add_type(env, t); + err = btf_add_type(env, t); + if (err) + return err; + cur += meta_size; env->log_type_id++; } -- 2.34.1