* [PATCH bpf-next v1 2/3] libbpf: Drop btf_dump details from the BTF docs
2026-11-06 19:57 [PATCH bpf-next v1 1/3] Revert "libbpf: Fix use-after-free in btf__add_type" Ihor Solodrai
@ 2026-11-06 19:57 ` Ihor Solodrai
2026-11-06 19:57 ` [PATCH bpf-next v1 3/3] bpftool: Replace the type tag override table with two checks Ihor Solodrai
2026-11-07 0:50 ` [PATCH bpf-next v1 1/3] Revert "libbpf: Fix use-after-free in btf__add_type" patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Ihor Solodrai @ 2026-11-06 19:57 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Quentin Monnet
Cc: bpf, Alan Maguire, Yonghong Song
btf.rst describes the BTF format, but commit fbafb695c5d2 ("libbpf: Let
decl tags override how btf_dump renders type tags") and
commit 79dcfd3e36a7 ("libbpf, bpftool, resolve_btfids: Dump kflagged
BTF tags as is") added to it how btf_dump prints kflagged tags and decl
tags on type tags. The comments of btf__add_type_attr() and
btf__add_decl_attr() also prescribe what the string must contain,
though it is arbitrary text that depends on the use case.
Describe kflagged tags only as arbitrary annotations in both places.
Keep a short note on the type tag override in btf_dump.c, whose comment
pointed to btf.rst.
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/CAEf4BzYqq-o8SRTWyO=J6gBnSkZa=QYuEiBNuBEVndVsVYcExg@mail.gmail.com/
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
Documentation/bpf/btf.rst | 21 ++++-----------------
tools/lib/bpf/btf.c | 6 ++----
tools/lib/bpf/btf_dump.c | 2 +-
3 files changed, 7 insertions(+), 22 deletions(-)
diff --git a/Documentation/bpf/btf.rst b/Documentation/bpf/btf.rst
index 99833048de60..b618812390e4 100644
--- a/Documentation/bpf/btf.rst
+++ b/Documentation/bpf/btf.rst
@@ -506,14 +506,9 @@ If ``info.kind_flag`` is 0, then this is a normal decl tag, and the
``name_off`` encodes btf_decl_tag attribute string.
If ``info.kind_flag`` is 1, then the decl tag represents an arbitrary
-annotation. ``name_off`` encodes the complete annotation string, which
-``btf_dump`` prints unchanged at the declaration. For example, an attribute
-specifier is encoded as ``__attribute__((aligned(4)))``, including the
-wrapper. A macro can be encoded as its identifier, leaving its definition
-to the generated header or its user.
-
-``btf_dump`` also accepts decl tags that reference a ``type_tag``, as
-described under ``BTF_KIND_TYPE_TAG``.
+annotation. ``name_off`` encodes the complete annotation string. For
+example, an attribute specifier is encoded as
+``__attribute__((aligned(4)))``, including the wrapper.
2.2.18 BTF_KIND_TYPE_TAG
~~~~~~~~~~~~~~~~~~~~~~~~
@@ -544,15 +539,7 @@ string.
If ``info.kind_flag`` is 1, then the type tag represents an arbitrary
annotation. As with decl tags, ``name_off`` encodes the complete annotation
-string, which ``btf_dump`` prints unchanged. An attribute specifier must
-include its wrapper, for example ``__attribute__((address_space(1)))``.
-
-``btf_dump`` prints decl tags that reference a type tag, with
-``btf_decl_tag.component_idx`` of ``-1``, in place of that type tag. They
-are printed the same way as decl tags on declarations. This lets a split
-BTF built for a C dump change how the type tags of its base BTF are
-printed, without modifying the base. The kernel rejects decl tags that
-reference type tags.
+string, for example ``__attribute__((address_space(1)))``.
2.2.19 BTF_KIND_ENUM64
~~~~~~~~~~~~~~~~~~~~~~
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 448ee6acf519..a4bf01403a43 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -3064,8 +3064,7 @@ int btf__add_type_tag(struct btf *btf, const char *value, int ref_type_id)
* Append new BTF_KIND_TYPE_TAG type with:
* - *value*, non-empty/non-NULL tag value;
* - *ref_type_id* - referenced type ID, it might not exist yet;
- * The kind flag is set; btf_dump prints *value* unchanged.
- * Attribute specifiers must include the __attribute__((...)) wrapper.
+ * Set info->kflag to 1, indicating this tag is an arbitrary annotation
* Returns:
* - >0, type ID of newly added BTF type;
* - <0, on error.
@@ -3400,8 +3399,7 @@ int btf__add_decl_tag(struct btf *btf, const char *value, int ref_type_id,
* - *ref_type_id* - referenced type ID, it might not exist yet;
* - *component_idx* - -1 for tagging reference type, otherwise struct/union
* member or function argument index;
- * The kind flag is set; btf_dump prints *value* unchanged.
- * Attribute specifiers must include the __attribute__((...)) wrapper.
+ * Set info->kflag to 1, indicating this tag is an arbitrary annotation
* Returns:
* - >0, type ID of newly added BTF type;
* - <0, on error.
diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
index fcd97aa90589..023047214b17 100644
--- a/tools/lib/bpf/btf_dump.c
+++ b/tools/lib/bpf/btf_dump.c
@@ -1597,7 +1597,7 @@ static void btf_dump_emit_type_chain(struct btf_dump *d,
break;
case BTF_KIND_TYPE_TAG:
btf_dump_emit_mods(d, decls);
- /* decl tags override the type tag, see btf.rst */
+ /* decl tags on the type tag are printed in its place */
if (btf_dump_emit_decl_tags(d, id, -1))
break;
name = btf_name_of(d, t->name_off);
--
2.56.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH bpf-next v1 3/3] bpftool: Replace the type tag override table with two checks
2026-11-06 19:57 [PATCH bpf-next v1 1/3] Revert "libbpf: Fix use-after-free in btf__add_type" Ihor Solodrai
2026-11-06 19:57 ` [PATCH bpf-next v1 2/3] libbpf: Drop btf_dump details from the BTF docs Ihor Solodrai
@ 2026-11-06 19:57 ` Ihor Solodrai
2026-11-07 0:50 ` [PATCH bpf-next v1 1/3] Revert "libbpf: Fix use-after-free in btf__add_type" patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Ihor Solodrai @ 2026-11-06 19:57 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Quentin Monnet
Cc: bpf, Alan Maguire, Yonghong Song
btf_c_annotate_type_tags() looks each type tag up in a table of
overrides. The table holds two fixed cases, the "address_space(1)"
string of older kernel BTF and the plain "arena" tag, and is not
expected to grow.
Check for the two tags directly and drop the table.
No functional change.
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/CAEf4BzbpVnoqKnGAVKYRffraPpPWjnNFF2oFAnXmBkqd2V6vmg@mail.gmail.com/
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
tools/bpf/bpftool/btf.c | 33 ++++++++++++---------------------
1 file changed, 12 insertions(+), 21 deletions(-)
diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c
index c06b01f2c5b3..c51c2efde3ed 100644
--- a/tools/bpf/bpftool/btf.c
+++ b/tools/bpf/bpftool/btf.c
@@ -1096,38 +1096,29 @@ static struct sort_datum *sort_btf_c(const struct btf *btf)
* Kernel BTF keeps its type tags as the kernel expects them. Decl tags in
* the dump split choose how btf_dump prints them.
*/
-static const struct {
- bool kflag;
- const char *name;
- const char *override;
-} btf_c_type_tags[] = {
- /* the arena attribute in older kernel BTF */
- { true, "address_space(1)", "__attribute__((address_space(1)))" },
- /* __arena in include/linux/bpf_compiler_types.h */
- { false, "arena", "__bpf_arena" },
-};
-
static int btf_c_annotate_type_tags(struct btf *btf)
{
__u32 i, cnt = btf__type_cnt(btf);
- size_t j;
int err;
for (i = 1; i < cnt; i++) {
const struct btf_type *t = btf__type_by_id(btf, i);
- const char *name;
+ const char *name, *attr;
if (!btf_is_type_tag(t))
continue;
name = btf__name_by_offset(btf, t->name_off);
- for (j = 0; j < ARRAY_SIZE(btf_c_type_tags); j++) {
- if (btf_kflag(t) != btf_c_type_tags[j].kflag ||
- strcmp(name, btf_c_type_tags[j].name))
- continue;
- err = btf__add_decl_attr(btf, btf_c_type_tags[j].override, i, -1);
- if (err < 0)
- return err;
- }
+ if (btf_kflag(t) && !strcmp(name, "address_space(1)"))
+ /* the arena attribute in older kernel BTF */
+ attr = "__attribute__((address_space(1)))";
+ else if (!btf_kflag(t) && !strcmp(name, "arena"))
+ /* __arena in include/linux/bpf_compiler_types.h */
+ attr = "__bpf_arena";
+ else
+ continue;
+ err = btf__add_decl_attr(btf, attr, i, -1);
+ if (err < 0)
+ return err;
}
return 0;
--
2.56.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH bpf-next v1 1/3] Revert "libbpf: Fix use-after-free in btf__add_type"
2026-11-06 19:57 [PATCH bpf-next v1 1/3] Revert "libbpf: Fix use-after-free in btf__add_type" Ihor Solodrai
2026-11-06 19:57 ` [PATCH bpf-next v1 2/3] libbpf: Drop btf_dump details from the BTF docs Ihor Solodrai
2026-11-06 19:57 ` [PATCH bpf-next v1 3/3] bpftool: Replace the type tag override table with two checks Ihor Solodrai
@ 2026-11-07 0:50 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-11-07 0:50 UTC (permalink / raw)
To: Ihor Solodrai
Cc: ast, andrii, daniel, eddyz87, memxor, qmo, bpf, alan.maguire,
yonghong.song
Hello:
This series was applied to bpf/bpf-next.git (master)
by Andrii Nakryiko <andrii@kernel.org>:
On Fri, 6 Nov 2026 12:57:28 -0700 you wrote:
> This reverts commit 9abe2c42ecab6c86b54838d2d645ca2e10204606.
>
> The commit made btf_rewrite_str() make every base of the destination
> modifiable before taking a pointer to the source string, because
> looking the string up in a base made it modifiable and freed its raw
> data. Since commit efeb5ab5753d ("libbpf: Look up BTF strings without
> making BTF modifiable"), the lookup leaves the raw data in place, so
> the pointer stays valid.
>
> [...]
Here is the summary with links:
- [bpf-next,v1,1/3] Revert "libbpf: Fix use-after-free in btf__add_type"
https://git.kernel.org/bpf/bpf-next/c/2210e69db721
- [bpf-next,v1,2/3] libbpf: Drop btf_dump details from the BTF docs
https://git.kernel.org/bpf/bpf-next/c/9736b748ee82
- [bpf-next,v1,3/3] bpftool: Replace the type tag override table with two checks
https://git.kernel.org/bpf/bpf-next/c/ad6472e01a5f
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread