Re: [PATCH bpf-next 2/6] libbpf: Adjust btf_vlen() to return a __u32

[sashiko-bot@kernel.org]

Sashiko AI review found 2 potential issue(s):
- [High] Expansion of vlen from 16-bit to 24-bit introduces severe O(N^2) complexity issues in CO-RE relocation matching.
- [High] Lack of bounds checking in `btf_type_inc_vlen` corrupts the BTF type kind field upon overflow.
--

commit 05dfc0fce969915cd3d509a4e34a33558181e95d
Author: Alan Maguire <alan.maguire@oracle.com>

    libbpf: Adjust btf_vlen() to return a __u32
    
    Now that vlen is 24 bits, btf_vlen() must return a __u32.
    Adjust use cases in libbpf accordingly.

> diff --git a/tools/lib/bpf/relo_core.c b/tools/lib/bpf/relo_core.c
> index 0ccc8f548cbaa..6ae3f2a15ad0c 100644
> --- a/tools/lib/bpf/relo_core.c
> +++ b/tools/lib/bpf/relo_core.c
[ ... ]
> @@ -1457,8 +1457,8 @@ static bool bpf_core_names_match(const struct btf *local_btf, size_t local_name_
>  static int bpf_core_enums_match(const struct btf *local_btf, const struct btf_type *local_t,
>  				const struct btf *targ_btf, const struct btf_type *targ_t)
>  {
> -	__u16 local_vlen = btf_vlen(local_t);
> -	__u16 targ_vlen = btf_vlen(targ_t);
> +	__u32 local_vlen = btf_vlen(local_t);
> +	__u32 targ_vlen = btf_vlen(targ_t);
>  	int i, j;

Can this widened vlen boundary create performance issues during CO-RE
relocation?

Looking at bpf_core_enums_match() and bpf_core_composites_match(), they
iterate over both local and target BTF type members using nested loops. With
the previous 16-bit limit, the worst-case was ~4.29 billion iterations. By
expanding vlen to 24 bits (max 16.7 million), the worst-case iterations
expand to ~281 trillion.

Could a crafted BTF payload stall the libbpf parser and consuming user-space
daemons for a significant amount of time?

Since vlen has been expanded to 24 bits, could we also overflow the kind
field when adding elements to a BTF type?

tools/lib/bpf/btf.c:btf_type_inc_vlen() {
	t->info = btf_type_info(btf_kind(t), btf_vlen(t) + 1, btf_kflag(t));
}

tools/lib/bpf/libbpf_internal.h:btf_type_info() {
	return (kflag << 31) | (kind << 24) | vlen;
}

If a program dynamically builds a BTF type and exceeds 16,777,215 elements,
vlen reaches 1 << 24. Since the vlen and kind fields are contiguous, does
this mutate the structure's type kind rather than safely rejecting the
overflow?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260414195019.684531-1-alan.maguire@oracle.com?part=2