[PATCH bpf v4 10/11] libbpf: Reject truncated ldimm64 CO-RE relocations

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

CO-RE relocation of an ldimm64 instruction operates on two instruction
slots. The original ldimm64 support checked that the second slot existed
only on the resolved relocation path, leaving unresolved relocation
poisoning able to write past the instruction allocation. When CO-RE logic
was moved to the shared relocation implementation, even the resolved-path
check was lost because bpf_core_patch_insn() no longer received the
program length.

A malformed BPF ELF can therefore end a function after the first ldimm64
slot and attach a CO-RE relocation to it. libbpf allocates the instruction
array according to the function symbol size. bpf_core_patch_insn() then
reads the absent second slot while validating a resolved relocation or
writes a poison instruction past the allocation for an unresolved one.

Pass the total instruction count to the shared patch helper and reject a
terminal ldimm64 before either relocation result is handled. Thread the
count through the in-kernel caller as well, since it compiles the same
shared relocation implementation.

Fixes: eacaaed784e2 ("libbpf: Implement enum value-based CO-RE relocations")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/20260914140852.03DA21F0089B@smtp.kernel.org
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 include/linux/bpf.h       |  2 +-
 kernel/bpf/btf.c          |  6 +++---
 kernel/bpf/check_btf.c    |  2 +-
 tools/lib/bpf/libbpf.c    |  3 ++-
 tools/lib/bpf/relo_core.c | 11 +++++++++--
 tools/lib/bpf/relo_core.h |  5 +++--
 6 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index e57af902560c..62155d87ce31 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -3196,7 +3196,7 @@ bool btf_type_ids_nocast_alias(struct bpf_verifier_log *log,
 			       const struct btf *arg_btf, u32 arg_id);
 
 int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
-		   int relo_idx, void *insn);
+		   int relo_idx, void *insn, size_t insn_cnt);
 
 static inline bool unprivileged_ebpf_enabled(void)
 {
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index d67a169ba2bb..78cd9661cdbd 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -9729,7 +9729,7 @@ bpf_core_find_cands(struct bpf_core_ctx *ctx, u32 local_type_id)
 }
 
 int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
-		   int relo_idx, void *insn)
+		   int relo_idx, void *insn, size_t insn_cnt)
 {
 	bool need_cands = relo->kind != BPF_CORE_TYPE_ID_LOCAL;
 	struct bpf_core_cand_list cands = {};
@@ -9793,8 +9793,8 @@ int bpf_core_apply(struct bpf_core_ctx *ctx, const struct bpf_core_relo *relo,
 	if (err)
 		goto out;
 
-	err = bpf_core_patch_insn((void *)ctx->log, insn, relo->insn_off / 8, relo, relo_idx,
-				  &targ_res);
+	err = bpf_core_patch_insn((void *)ctx->log, insn, insn_cnt, relo->insn_off / 8,
+				  relo, relo_idx, &targ_res);
 
 out:
 	kfree(specs);
diff --git a/kernel/bpf/check_btf.c b/kernel/bpf/check_btf.c
index 4c1ed842f661..63d0375f5bb0 100644
--- a/kernel/bpf/check_btf.c
+++ b/kernel/bpf/check_btf.c
@@ -399,7 +399,7 @@ int bpf_check_core_relo(struct bpf_verifier_env *env,
 		}
 
 		err = bpf_core_apply(&ctx, &core_relo, i,
-				     &prog->insnsi[core_relo.insn_off / 8]);
+				     &prog->insnsi[core_relo.insn_off / 8], prog->len);
 		if (err)
 			break;
 		bpfptr_add(&u_core_relo, rec_size);
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index b749c01742ee..619e664f0c00 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -6223,7 +6223,8 @@ bpf_object__relocate_core(struct bpf_object *obj, const char *targ_btf_path)
 				goto out;
 			}
 
-			err = bpf_core_patch_insn(prog->name, insn, insn_idx, rec, i, &targ_res);
+			err = bpf_core_patch_insn(prog->name, insn, prog->insns_cnt, insn_idx,
+						  rec, i, &targ_res);
 			if (err) {
 				pr_warn("prog '%s': relo #%d: failed to patch insn #%d: %s\n",
 					prog->name, i, insn_idx, errstr(err));
diff --git a/tools/lib/bpf/relo_core.c b/tools/lib/bpf/relo_core.c
index 2672623a4198..92ff923f0d13 100644
--- a/tools/lib/bpf/relo_core.c
+++ b/tools/lib/bpf/relo_core.c
@@ -1046,12 +1046,19 @@ static int insn_bytes_to_bpf_size(__u32 sz)
  * 6. *(T *)(rX + <off>) = <imm>, where T is one of {u8, u16, u32, u64}.
  */
 int bpf_core_patch_insn(const char *prog_name, struct bpf_insn *insn,
-			int insn_idx, const struct bpf_core_relo *relo,
-			int relo_idx, const struct bpf_core_relo_res *res)
+			size_t insn_cnt, int insn_idx,
+			const struct bpf_core_relo *relo, int relo_idx,
+			const struct bpf_core_relo_res *res)
 {
 	__u64 orig_val, new_val;
 	__u8 class;
 
+	if (is_ldimm64_insn(insn) && (size_t)insn_idx + 1 >= insn_cnt) {
+		pr_warn("prog '%s': relo #%d: insn #%d (LDIMM64) is truncated\n",
+			prog_name, relo_idx, insn_idx);
+		return -EINVAL;
+	}
+
 	class = BPF_CLASS(insn->code);
 
 	orig_val = res->orig_val;
diff --git a/tools/lib/bpf/relo_core.h b/tools/lib/bpf/relo_core.h
index 1c0566daf8e8..db2e106dc73d 100644
--- a/tools/lib/bpf/relo_core.h
+++ b/tools/lib/bpf/relo_core.h
@@ -87,8 +87,9 @@ int bpf_core_calc_relo_insn(const char *prog_name,
 			    struct bpf_core_relo_res *targ_res);
 
 int bpf_core_patch_insn(const char *prog_name, struct bpf_insn *insn,
-			int insn_idx, const struct bpf_core_relo *relo,
-			int relo_idx, const struct bpf_core_relo_res *res);
+			size_t insn_cnt, int insn_idx,
+			const struct bpf_core_relo *relo, int relo_idx,
+			const struct bpf_core_relo_res *res);
 
 int bpf_core_parse_spec(const char *prog_name, const struct btf *btf,
 		        const struct bpf_core_relo *relo,
-- 
2.53.0