[PATCH bpf-next 0/3] Inline BTF followups

[PATCH bpf-next 0/3] Inline BTF followups

[Alan Maguire]

This series addresses lingering issues after BTF inline
series landed.

Patch 1 fixes validation issue on loading BTF inline info.

Patch 2 corrects the base address calculation for BTF inline
data in LOCSEC to use the ELF section base rather than module
base.

Patch 3 enables BTF inline info for CI config.

Alan Maguire (3):
  btf: Fix size/vlen validation for BTF_KIND_LOC_PARAM
  selftests/bpf: Fix btf_inline to use .text section as base
  selftests/bpf: Enable CONFIG_DEBUG_INFO_BTF_INLINE for CI

 kernel/bpf/btf.c                              |  8 ++++----
 tools/testing/selftests/bpf/config            |  1 +
 .../selftests/bpf/prog_tests/btf_inline.c     |  5 +++--
 tools/testing/selftests/bpf/trace_helpers.c   | 19 +++++++++++++++++++
 tools/testing/selftests/bpf/trace_helpers.h   |  1 +
 5 files changed, 28 insertions(+), 6 deletions(-)

-- 
2.43.5

[PATCH bpf-next 1/3] btf: Fix size/vlen validation for BTF_KIND_LOC_PARAM

[Alan Maguire]

Validation logic allowed a BTF_KIND_LOC_PARAM with size <= 4
and vlen == 2, an inconsistent representation.

Fixes: a3df11403e8c8 ("bpf: Verify BTF_KIND_LOC_PARAM vlen, flags")
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
---
 kernel/bpf/btf.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index b09c04ccdc6d..64c78434fa05 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -4827,12 +4827,12 @@ static s32 btf_loc_param_check_meta(struct btf_verifier_env *env,
 	case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_SIGNED:
 	case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR:
 	case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR | BTF_LOC_PARAM_SIGNED:
-		if (vlen > 2)
+		if (vlen < 1 || vlen > 2)
 			goto invalid_vlen;
-		/* Ensure size/vlen are consistent */
-		if (size > sizeof(__u32) && vlen != 2)
+		if (!size || size > sizeof(__u64))
 			goto invalid_vlen;
-		if (size > sizeof(__u64))
+		/* Ensure size/vlen are consistent */
+		if (vlen != (size > sizeof(__u32) ? 2 : 1))
 			goto invalid_vlen;
 		break;
 	case BTF_LOC_PARAM_REG:
-- 
2.43.5

Re: [PATCH bpf-next 1/3] btf: Fix size/vlen validation for BTF_KIND_LOC_PARAM

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 2032 bytes --]

> btf: Fix size/vlen validation for BTF_KIND_LOC_PARAM

TL;DR: Nit only, not a bug: the new "vlen < 1", "!size" and "vlen > 2" checks
in btf_loc_param_check_meta()'s CONST case look redundant with earlier checks
and could be dropped.

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c

[ ... ]

> @@ -4827,12 +4827,12 @@ static s32 btf_loc_param_check_meta(struct btf_verifier_env *env,
>  	case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_SIGNED:
>  	case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR:
>  	case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR | BTF_LOC_PARAM_SIGNED:
> -		if (vlen > 2)
> +		if (vlen < 1 || vlen > 2)
>  			goto invalid_vlen;
> -		/* Ensure size/vlen are consistent */
> -		if (size > sizeof(__u32) && vlen != 2)
> +		if (!size || size > sizeof(__u64))
>  			goto invalid_vlen;
> -		if (size > sizeof(__u64))
> +		/* Ensure size/vlen are consistent */
> +		if (vlen != (size > sizeof(__u32) ? 2 : 1))
>  			goto invalid_vlen;
>  		break;
>  	case BTF_LOC_PARAM_REG:

This isn't a bug, but are the new "vlen < 1" and "!size" terms reachable?

btf_loc_param_check_meta() already rejects "!size || size > 16" as an
unexpected size, and rejects "vlen < 1" with "All LOC_PARAMs have vlen of at
least 1", before reaching this switch.

The final check, "vlen != (size > sizeof(__u32) ? 2 : 1)", also already
limits vlen to exactly 1 or 2, so the "vlen < 1 || vlen > 2" test looks
redundant with it.

Since !size and vlen < 1 are already rejected before the switch, and the
vlen != (size > 4 ? 2 : 1) test already limits vlen to 1 or 2, could the
CONST case just be the "size > sizeof(__u64)" check plus the consistency
check?  The neighbouring BTF_LOC_PARAM_REG case only tests "vlen > 2" and
relies on the checks before the switch.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/38263660345

Re: [PATCH bpf-next 1/3] btf: Fix size/vlen validation for BTF_KIND_LOC_PARAM

[Jiri Olsa]

On Mon, Oct 12, 2026 at 03:06:38PM +0100, Alan Maguire wrote:
> Validation logic allowed a BTF_KIND_LOC_PARAM with size <= 4
> and vlen == 2, an inconsistent representation.
> 
> Fixes: a3df11403e8c8 ("bpf: Verify BTF_KIND_LOC_PARAM vlen, flags")
> Suggested-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
> ---
>  kernel/bpf/btf.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index b09c04ccdc6d..64c78434fa05 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -4827,12 +4827,12 @@ static s32 btf_loc_param_check_meta(struct btf_verifier_env *env,
>  	case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_SIGNED:
>  	case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR:
>  	case BTF_LOC_PARAM_CONST | BTF_LOC_PARAM_ADDR | BTF_LOC_PARAM_SIGNED:
> -		if (vlen > 2)
> +		if (vlen < 1 || vlen > 2)
>  			goto invalid_vlen;

nit, is this condition needed? the check down ensures vlen is 1 or 2

jirka

> -		/* Ensure size/vlen are consistent */
> -		if (size > sizeof(__u32) && vlen != 2)
> +		if (!size || size > sizeof(__u64))
>  			goto invalid_vlen;
> -		if (size > sizeof(__u64))
> +		/* Ensure size/vlen are consistent */
> +		if (vlen != (size > sizeof(__u32) ? 2 : 1))
>  			goto invalid_vlen;
>  		break;
>  	case BTF_LOC_PARAM_REG:
> -- 
> 2.43.5
> 

[PATCH bpf-next 2/3] selftests/bpf: Fix btf_inline to use .text section as base

[Alan Maguire]

Relative addresses in LOCSEC are relative to the associated
ELF section for the LOCSEC "inline<section>"; in the case of
this test, it is ".text".  Fix the test to compute the address
via the section base rather than the overall module base address.

Since addresses in BTF inline LOC_PARAMs can be module base-relative,
do not remove the module base calcuation function.

Fixes: 400f0881c912 ("selftests/bpf: Add a test verifying inline information")
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
---
 .../selftests/bpf/prog_tests/btf_inline.c     |  5 +++--
 tools/testing/selftests/bpf/trace_helpers.c   | 19 +++++++++++++++++++
 tools/testing/selftests/bpf/trace_helpers.h   |  1 +
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/btf_inline.c b/tools/testing/selftests/bpf/prog_tests/btf_inline.c
index d88fab6429b1..e630e5f0f5fa 100644
--- a/tools/testing/selftests/bpf/prog_tests/btf_inline.c
+++ b/tools/testing/selftests/bpf/prog_tests/btf_inline.c
@@ -32,7 +32,8 @@ void test_btf_inline(void)
 		return;
 	}
 
-	base_addr = module_get_base_addr("bpf_testmod");
+	/* LOCSEC offsets are relative to the ELF section base. */
+	base_addr = module_get_base_addr_sec("bpf_testmod", ".text");
 	if (!ASSERT_NEQ(base_addr, 0, "base_addr_nonzero"))
 		return;
 
@@ -41,7 +42,7 @@ void test_btf_inline(void)
 		return;
 	if (!ASSERT_NEQ(caller_addr, 0, "caller_addr_nonzero"))
 		return;
-	if (!ASSERT_GT(caller_addr, base_addr, "caller_addr_gt_base_addr"))
+	if (!ASSERT_GE(caller_addr, base_addr, "caller_addr_ge_base_addr"))
 		return;
 	caller_addr -= base_addr;
 
diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c
index f3a1d627699d..6d7a4b8c4ab8 100644
--- a/tools/testing/selftests/bpf/trace_helpers.c
+++ b/tools/testing/selftests/bpf/trace_helpers.c
@@ -264,6 +264,25 @@ unsigned long long module_get_base_addr(const char *module)
 	return base_addr;
 }
 
+unsigned long long module_get_base_addr_sec(const char *module, const char *sec)
+{
+	unsigned long long addr = 0;
+	char *path;
+	FILE *f;
+
+	if (asprintf(&path, "/sys/module/%s/sections/%s", module, sec) < 0)
+		return 0;
+	f = fopen(path, "r");
+	free(path);
+	if (!f)
+		return 0;
+
+	if (fscanf(f, "%llx", &addr) != 1)
+		addr = 0;
+	fclose(f);
+	return addr;
+}
+
 #ifdef PROCMAP_QUERY
 int env_verbosity __weak = 0;
 
diff --git a/tools/testing/selftests/bpf/trace_helpers.h b/tools/testing/selftests/bpf/trace_helpers.h
index eb0d0d9804d6..0f8d99746084 100644
--- a/tools/testing/selftests/bpf/trace_helpers.h
+++ b/tools/testing/selftests/bpf/trace_helpers.h
@@ -39,6 +39,7 @@ int load_kallsyms(void);
 struct ksym *ksym_search(long key);
 long ksym_get_addr(const char *name);
 unsigned long long module_get_base_addr(const char *module);
+unsigned long long module_get_base_addr_sec(const char *module, const char *sec);
 
 struct ksyms *load_kallsyms_local(void);
 struct ksym *ksym_search_local(struct ksyms *ksyms, long key);
-- 
2.43.5

[PATCH bpf-next 3/3] selftests/bpf: Enable CONFIG_DEBUG_INFO_BTF_INLINE for CI

[Alan Maguire]

Ensure we add inline info to BTF for testing.

Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
---
 tools/testing/selftests/bpf/config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config
index 2b883b388f90..d1a19fb125dd 100644
--- a/tools/testing/selftests/bpf/config
+++ b/tools/testing/selftests/bpf/config
@@ -23,6 +23,7 @@ CONFIG_CRYPTO_ECB=y
 CONFIG_CRYPTO_AES=y
 CONFIG_DEBUG_INFO=y
 CONFIG_DEBUG_INFO_BTF=y
+CONFIG_DEBUG_INFO_BTF_INLINE=y
 CONFIG_DEBUG_INFO_DWARF4=y
 CONFIG_DMABUF_HEAPS=y
 CONFIG_DMABUF_HEAPS_SYSTEM=y
-- 
2.43.5

Re: [PATCH bpf-next 0/3] Inline BTF followups

[Jiri Olsa]

On Mon, Oct 12, 2026 at 03:06:37PM +0100, Alan Maguire wrote:
> This series addresses lingering issues after BTF inline
> series landed.
> 
> Patch 1 fixes validation issue on loading BTF inline info.
> 
> Patch 2 corrects the base address calculation for BTF inline
> data in LOCSEC to use the ELF section base rather than module
> base.
> 
> Patch 3 enables BTF inline info for CI config.
> 
> Alan Maguire (3):
>   btf: Fix size/vlen validation for BTF_KIND_LOC_PARAM
>   selftests/bpf: Fix btf_inline to use .text section as base
>   selftests/bpf: Enable CONFIG_DEBUG_INFO_BTF_INLINE for CI

Acked-by: Jiri Olsa <jolsa@kernel.org>

jirka

> 
>  kernel/bpf/btf.c                              |  8 ++++----
>  tools/testing/selftests/bpf/config            |  1 +
>  .../selftests/bpf/prog_tests/btf_inline.c     |  5 +++--
>  tools/testing/selftests/bpf/trace_helpers.c   | 19 +++++++++++++++++++
>  tools/testing/selftests/bpf/trace_helpers.h   |  1 +
>  5 files changed, 28 insertions(+), 6 deletions(-)
> 
> -- 
> 2.43.5
> 

Re: [PATCH bpf-next 0/3] Inline BTF followups

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Mon, 12 Oct 2026 15:06:37 +0100 you wrote:
> This series addresses lingering issues after BTF inline
> series landed.
> 
> Patch 1 fixes validation issue on loading BTF inline info.
> 
> Patch 2 corrects the base address calculation for BTF inline
> data in LOCSEC to use the ELF section base rather than module
> base.
> 
> [...]

Here is the summary with links:
  - [bpf-next,1/3] btf: Fix size/vlen validation for BTF_KIND_LOC_PARAM
    https://git.kernel.org/bpf/bpf-next/c/f6b6c87262da
  - [bpf-next,2/3] selftests/bpf: Fix btf_inline to use .text section as base
    https://git.kernel.org/bpf/bpf-next/c/35369ca4954c
  - [bpf-next,3/3] selftests/bpf: Enable CONFIG_DEBUG_INFO_BTF_INLINE for CI
    https://git.kernel.org/bpf/bpf-next/c/add69af5068d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html