[PATCH bpf-next v1 1/3] Revert "libbpf: Fix use-after-free in btf__add_type"

[PATCH bpf-next v1 1/3] Revert "libbpf: Fix use-after-free in btf__add_type"

[Ihor Solodrai]

This reverts commit 9abe2c42ecab6c86b54838d2d645ca2e10204606.

The commit made btf_rewrite_str() make every base of the destination
modifiable before taking a pointer to the source string, because
looking the string up in a base made it modifiable and freed its raw
data. Since commit efeb5ab5753d ("libbpf: Look up BTF strings without
making BTF modifiable"), the lookup leaves the raw data in place, so
the pointer stays valid.

Making a base modifiable fails for BTF with unknown header-extension
bytes. With the loop in place, btf__add_type() and btf__add_btf() into
a split over such a base fail with -EOPNOTSUPP, and so does bpftool
when it merges module BTFs over it:

  $ bpftool -B base.btf btf dump file mod1.btf file mod2.btf format raw
  Error: failed to merge BTF from mod1.btf: Operation not supported

Suggested-by: BPF CI bot <bot+bpf-ci@kernel.org>
Link: https://lore.kernel.org/bpf/e0df4fa9e17514c79de41ee9fd2eb610d43a95741fb994db160b35fd488f054a@mail.kernel.org/
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
 tools/lib/bpf/btf.c | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 0984a8ccb526..448ee6acf519 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -2232,7 +2232,6 @@ struct btf_pipe {
 
 static int btf_rewrite_str(struct btf_pipe *p, __u32 *str_off)
 {
-	struct btf *base;
 	long mapped_off;
 	int off, err;
 
@@ -2245,19 +2244,6 @@ static int btf_rewrite_str(struct btf_pipe *p, __u32 *str_off)
 		return 0;
 	}
 
-	/*
-	 * btf__add_str() first looks the string up in the base BTFs of dst,
-	 * which makes each of them modifiable and frees its raw data. If src
-	 * shares a base with dst and the string lives in that base, the
-	 * pointer taken below would be left dangling. So make the bases
-	 * modifiable before the pointer is taken.
-	 */
-	for (base = p->dst->base_btf; base; base = base->base_btf) {
-		err = btf_ensure_modifiable(base);
-		if (err)
-			return err;
-	}
-
 	off = btf__add_str(p->dst, btf__str_by_offset(p->src, *str_off));
 	if (off < 0)
 		return off;

base-commit: 3e18218484126afb9da722080659c038cb2256ab
-- 
2.56.0

[PATCH bpf-next v1 2/3] libbpf: Drop btf_dump details from the BTF docs

[Ihor Solodrai]

btf.rst describes the BTF format, but commit fbafb695c5d2 ("libbpf: Let
decl tags override how btf_dump renders type tags") and
commit 79dcfd3e36a7 ("libbpf, bpftool, resolve_btfids: Dump kflagged
BTF tags as is") added to it how btf_dump prints kflagged tags and decl
tags on type tags. The comments of btf__add_type_attr() and
btf__add_decl_attr() also prescribe what the string must contain,
though it is arbitrary text that depends on the use case.

Describe kflagged tags only as arbitrary annotations in both places.
Keep a short note on the type tag override in btf_dump.c, whose comment
pointed to btf.rst.

Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/CAEf4BzYqq-o8SRTWyO=J6gBnSkZa=QYuEiBNuBEVndVsVYcExg@mail.gmail.com/
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
 Documentation/bpf/btf.rst | 21 ++++-----------------
 tools/lib/bpf/btf.c       |  6 ++----
 tools/lib/bpf/btf_dump.c  |  2 +-
 3 files changed, 7 insertions(+), 22 deletions(-)

diff --git a/Documentation/bpf/btf.rst b/Documentation/bpf/btf.rst
index 99833048de60..b618812390e4 100644
--- a/Documentation/bpf/btf.rst
+++ b/Documentation/bpf/btf.rst
@@ -506,14 +506,9 @@ If ``info.kind_flag`` is 0, then this is a normal decl tag, and the
 ``name_off`` encodes btf_decl_tag attribute string.
 
 If ``info.kind_flag`` is 1, then the decl tag represents an arbitrary
-annotation. ``name_off`` encodes the complete annotation string, which
-``btf_dump`` prints unchanged at the declaration. For example, an attribute
-specifier is encoded as ``__attribute__((aligned(4)))``, including the
-wrapper. A macro can be encoded as its identifier, leaving its definition
-to the generated header or its user.
-
-``btf_dump`` also accepts decl tags that reference a ``type_tag``, as
-described under ``BTF_KIND_TYPE_TAG``.
+annotation. ``name_off`` encodes the complete annotation string. For
+example, an attribute specifier is encoded as
+``__attribute__((aligned(4)))``, including the wrapper.
 
 2.2.18 BTF_KIND_TYPE_TAG
 ~~~~~~~~~~~~~~~~~~~~~~~~
@@ -544,15 +539,7 @@ string.
 
 If ``info.kind_flag`` is 1, then the type tag represents an arbitrary
 annotation. As with decl tags, ``name_off`` encodes the complete annotation
-string, which ``btf_dump`` prints unchanged. An attribute specifier must
-include its wrapper, for example ``__attribute__((address_space(1)))``.
-
-``btf_dump`` prints decl tags that reference a type tag, with
-``btf_decl_tag.component_idx`` of ``-1``, in place of that type tag. They
-are printed the same way as decl tags on declarations. This lets a split
-BTF built for a C dump change how the type tags of its base BTF are
-printed, without modifying the base. The kernel rejects decl tags that
-reference type tags.
+string, for example ``__attribute__((address_space(1)))``.
 
 2.2.19 BTF_KIND_ENUM64
 ~~~~~~~~~~~~~~~~~~~~~~
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 448ee6acf519..a4bf01403a43 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -3064,8 +3064,7 @@ int btf__add_type_tag(struct btf *btf, const char *value, int ref_type_id)
  * Append new BTF_KIND_TYPE_TAG type with:
  *   - *value*, non-empty/non-NULL tag value;
  *   - *ref_type_id* - referenced type ID, it might not exist yet;
- * The kind flag is set; btf_dump prints *value* unchanged.
- * Attribute specifiers must include the __attribute__((...)) wrapper.
+ * Set info->kflag to 1, indicating this tag is an arbitrary annotation
  * Returns:
  *   - >0, type ID of newly added BTF type;
  *   - <0, on error.
@@ -3400,8 +3399,7 @@ int btf__add_decl_tag(struct btf *btf, const char *value, int ref_type_id,
  *   - *ref_type_id* - referenced type ID, it might not exist yet;
  *   - *component_idx* - -1 for tagging reference type, otherwise struct/union
  *     member or function argument index;
- * The kind flag is set; btf_dump prints *value* unchanged.
- * Attribute specifiers must include the __attribute__((...)) wrapper.
+ * Set info->kflag to 1, indicating this tag is an arbitrary annotation
  * Returns:
  *   - >0, type ID of newly added BTF type;
  *   - <0, on error.
diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
index fcd97aa90589..023047214b17 100644
--- a/tools/lib/bpf/btf_dump.c
+++ b/tools/lib/bpf/btf_dump.c
@@ -1597,7 +1597,7 @@ static void btf_dump_emit_type_chain(struct btf_dump *d,
 			break;
 		case BTF_KIND_TYPE_TAG:
 			btf_dump_emit_mods(d, decls);
-			/* decl tags override the type tag, see btf.rst */
+			/* decl tags on the type tag are printed in its place */
 			if (btf_dump_emit_decl_tags(d, id, -1))
 				break;
 			name = btf_name_of(d, t->name_off);
-- 
2.56.0

[PATCH bpf-next v1 3/3] bpftool: Replace the type tag override table with two checks

[Ihor Solodrai]

btf_c_annotate_type_tags() looks each type tag up in a table of
overrides. The table holds two fixed cases, the "address_space(1)"
string of older kernel BTF and the plain "arena" tag, and is not
expected to grow.

Check for the two tags directly and drop the table.

No functional change.

Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/CAEf4BzbpVnoqKnGAVKYRffraPpPWjnNFF2oFAnXmBkqd2V6vmg@mail.gmail.com/
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
 tools/bpf/bpftool/btf.c | 33 ++++++++++++---------------------
 1 file changed, 12 insertions(+), 21 deletions(-)

diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c
index c06b01f2c5b3..c51c2efde3ed 100644
--- a/tools/bpf/bpftool/btf.c
+++ b/tools/bpf/bpftool/btf.c
@@ -1096,38 +1096,29 @@ static struct sort_datum *sort_btf_c(const struct btf *btf)
  * Kernel BTF keeps its type tags as the kernel expects them. Decl tags in
  * the dump split choose how btf_dump prints them.
  */
-static const struct {
-	bool kflag;
-	const char *name;
-	const char *override;
-} btf_c_type_tags[] = {
-	/* the arena attribute in older kernel BTF */
-	{ true, "address_space(1)", "__attribute__((address_space(1)))" },
-	/* __arena in include/linux/bpf_compiler_types.h */
-	{ false, "arena", "__bpf_arena" },
-};
-
 static int btf_c_annotate_type_tags(struct btf *btf)
 {
 	__u32 i, cnt = btf__type_cnt(btf);
-	size_t j;
 	int err;
 
 	for (i = 1; i < cnt; i++) {
 		const struct btf_type *t = btf__type_by_id(btf, i);
-		const char *name;
+		const char *name, *attr;
 
 		if (!btf_is_type_tag(t))
 			continue;
 		name = btf__name_by_offset(btf, t->name_off);
-		for (j = 0; j < ARRAY_SIZE(btf_c_type_tags); j++) {
-			if (btf_kflag(t) != btf_c_type_tags[j].kflag ||
-			    strcmp(name, btf_c_type_tags[j].name))
-				continue;
-			err = btf__add_decl_attr(btf, btf_c_type_tags[j].override, i, -1);
-			if (err < 0)
-				return err;
-		}
+		if (btf_kflag(t) && !strcmp(name, "address_space(1)"))
+			/* the arena attribute in older kernel BTF */
+			attr = "__attribute__((address_space(1)))";
+		else if (!btf_kflag(t) && !strcmp(name, "arena"))
+			/* __arena in include/linux/bpf_compiler_types.h */
+			attr = "__bpf_arena";
+		else
+			continue;
+		err = btf__add_decl_attr(btf, attr, i, -1);
+		if (err < 0)
+			return err;
 	}
 
 	return 0;
-- 
2.56.0

Re: [PATCH bpf-next v1 1/3] Revert "libbpf: Fix use-after-free in btf__add_type"

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Andrii Nakryiko <andrii@kernel.org>:

On Fri,  6 Nov 2026 12:57:28 -0700 you wrote:
> This reverts commit 9abe2c42ecab6c86b54838d2d645ca2e10204606.
> 
> The commit made btf_rewrite_str() make every base of the destination
> modifiable before taking a pointer to the source string, because
> looking the string up in a base made it modifiable and freed its raw
> data. Since commit efeb5ab5753d ("libbpf: Look up BTF strings without
> making BTF modifiable"), the lookup leaves the raw data in place, so
> the pointer stays valid.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v1,1/3] Revert "libbpf: Fix use-after-free in btf__add_type"
    https://git.kernel.org/bpf/bpf-next/c/2210e69db721
  - [bpf-next,v1,2/3] libbpf: Drop btf_dump details from the BTF docs
    https://git.kernel.org/bpf/bpf-next/c/9736b748ee82
  - [bpf-next,v1,3/3] bpftool: Replace the type tag override table with two checks
    https://git.kernel.org/bpf/bpf-next/c/ad6472e01a5f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html