From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: <bot+bpf-ci@kernel.org>, <bpf@vger.kernel.org>
Cc: <daniel@iogearbox.net>, <andrii@kernel.org>, <eddyz87@gmail.com>,
<memxor@gmail.com>, <martin.lau@kernel.org>,
<yonghong.song@linux.dev>, <mason@kernel.org>,
<ihor.solodrai@linux.dev>
Subject: Re: [PATCH bpf-next v3 06/14] libbpf: Relocate pointers that are stored in arena
Date: Wed, 04 Nov 2026 02:30:37 +0000 [thread overview]
Message-ID: <DMM2NHPR2UJS.P9V6P9HRJFK6@gmail.com> (raw)
In-Reply-To: <f4144b15c814d1c4ed9be5e4e4f4f8f5746bb7638ad8234210e5dd2524b1e151@mail.kernel.org>
On Tue, Nov 03, 2026 at 05:59 PM bot+bpf-ci@kernel.org <bot+bpf-ci@kernel.org> wrote:
>> + ptrs->off = rel->r_offset;
>> + ptrs->targ_off = sym->st_value;
>
> Can rel->r_offset point past the end of the arena data here? It is stored
> in ptrs->off without being compared against the size of the .addr_space.1
> data.
[...]
> Should this function do a similar check and return -LIBBPF_ERRNO__FORMAT?
Not a bug. Only a hand-made ELF has such r_offset.
The input of libbpf is trusted.
I thought bpf CI knows this better than sashiko :(
> relocate_arena_ptrs() would then read past the heap allocation and use
> garbage off values as write targets. Should a second call be rejected when
> obj->arena_ptrs is already set?
No. See my reply to sashiko.
next prev parent reply other threads:[~2026-11-04 2:30 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-04 1:23 [PATCH bpf-next v3 00/14] bpf: A stack in arena Alexei Starovoitov
2026-11-04 1:23 ` [PATCH bpf-next v3 01/14] libbpf: Make arena 4 Gbyte when max_entries is not set Alexei Starovoitov
2026-11-04 1:23 ` [PATCH bpf-next v3 02/14] selftests/bpf: Test the default size of arena Alexei Starovoitov
2026-11-04 1:23 ` [PATCH bpf-next v3 03/14] bpf: Treat addr_space_cast of a pointer that is not in arena as a move Alexei Starovoitov
2026-11-04 2:12 ` bot+bpf-ci
2026-11-04 2:32 ` Alexei Starovoitov
2026-11-04 1:23 ` [PATCH bpf-next v3 04/14] selftests/bpf: Test addr_space_cast of pointers that are not in arena Alexei Starovoitov
2026-11-04 1:40 ` sashiko-bot
2026-11-04 1:23 ` [PATCH bpf-next v3 05/14] libbpf: Support .bss.addr_space.1 section Alexei Starovoitov
2026-11-04 1:59 ` bot+bpf-ci
2026-11-04 1:23 ` [PATCH bpf-next v3 06/14] libbpf: Relocate pointers that are stored in arena Alexei Starovoitov
2026-11-04 1:44 ` sashiko-bot
2026-11-04 2:02 ` Alexei Starovoitov
2026-11-04 2:32 ` Roman Gushchin
2026-11-04 2:37 ` Alexei Starovoitov
2026-11-04 1:59 ` bot+bpf-ci
2026-11-04 2:30 ` Alexei Starovoitov [this message]
2026-11-04 1:23 ` [PATCH bpf-next v3 07/14] selftests/bpf: Test pointers in arena and .bss.addr_space.1 Alexei Starovoitov
2026-11-04 1:23 ` [PATCH bpf-next v3 08/14] bpf: Introduce bpf register BPF_REG_ARENA_SP Alexei Starovoitov
2026-11-04 1:23 ` [PATCH bpf-next v3 09/14] bpf: Add stacks for programs to arena Alexei Starovoitov
2026-11-04 1:23 ` [PATCH bpf-next v3 10/14] bpf, x86: Add BPF_ATOMIC_LOCAL Alexei Starovoitov
2026-11-04 1:23 ` [PATCH bpf-next v3 11/14] bpf: Support BPF_REG_ARENA_SP in the verifier Alexei Starovoitov
2026-11-04 2:12 ` bot+bpf-ci
2026-11-04 1:23 ` [PATCH bpf-next v3 12/14] bpf, x86: Support BPF_REG_ARENA_SP Alexei Starovoitov
2026-11-04 1:23 ` [PATCH bpf-next v3 13/14] bpf, arm64: " Alexei Starovoitov
2026-11-04 1:24 ` [PATCH bpf-next v3 14/14] selftests/bpf: Add tests for BPF_REG_ARENA_SP Alexei Starovoitov
2026-11-04 2:12 ` bot+bpf-ci
2026-11-04 2:29 ` Alexei Starovoitov
2026-11-04 3:31 ` [PATCH bpf-next v3 00/14] bpf: A stack in arena Alexei Starovoitov
2026-11-04 7:35 ` Kumar Kartikeya Dwivedi
2026-11-04 18:02 ` Alexei Starovoitov
2026-11-04 20:10 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DMM2NHPR2UJS.P9V6P9HRJFK6@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=bot+bpf-ci@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=ihor.solodrai@linux.dev \
--cc=martin.lau@kernel.org \
--cc=mason@kernel.org \
--cc=memxor@gmail.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.