[PATCH bpf-next] bpf: Propagate btf_add_type() errors in btf_check_all_metas()

[PATCH bpf-next] bpf: Propagate btf_add_type() errors in btf_check_all_metas()

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

btf_check_all_metas() ignores the return value of btf_add_type(), so a
type that could not be registered is silently dropped while the loop
keeps walking over the type section.

Both failure modes are reachable:

  - -E2BIG.  Once the types array reaches its capacity (BTF_MAX_TYPE),
    every following btf_add_type() fails the same way, so
    btf_check_all_metas() still returns 0 and the BTF object is created
    with btf->nr_types capped while hdr->type_len claims more records.

  - -ENOMEM.  btf->nr_types is not incremented and the array is not
    grown, so the next type is recorded at the slot of the dropped one
    and btf->types[] stays off by one with respect to the type ids for
    all remaining types.  btf_type_by_id() then returns the wrong type
    for those ids for the whole lifetime of the object, and the last
    type is silently left unresolved.

Propagate the error so that the object is rejected instead.

Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)")
Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
---
 kernel/bpf/btf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index d870bc5e50bc..80b6f96263f1 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -5459,6 +5459,7 @@ static int btf_check_all_metas(struct btf_verifier_env *env)
 	struct btf *btf = env->btf;
 	struct btf_header *hdr;
 	void *cur, *end;
+	int err;
 
 	hdr = &btf->hdr;
 	cur = btf->nohdr_data + hdr->type_off;
@@ -5473,7 +5474,10 @@ static int btf_check_all_metas(struct btf_verifier_env *env)
 		if (meta_size < 0)
 			return meta_size;
 
-		btf_add_type(env, t);
+		err = btf_add_type(env, t);
+		if (err)
+			return err;
+
 		cur += meta_size;
 		env->log_type_id++;
 	}
-- 
2.25.1

Re: [PATCH bpf-next] bpf: Propagate btf_add_type() errors in btf_check_all_metas()

[Mahe Tardy]

On Thu, Oct 22, 2026 at 02:47:27PM +0800, Feng Yang wrote:
> From: Feng Yang <yangfeng@kylinos.cn>
> 
> btf_check_all_metas() ignores the return value of btf_add_type(), so a
> type that could not be registered is silently dropped while the loop
> keeps walking over the type section.
> 
> Both failure modes are reachable:
> 
>   - -E2BIG.  Once the types array reaches its capacity (BTF_MAX_TYPE),
>     every following btf_add_type() fails the same way, so
>     btf_check_all_metas() still returns 0 and the BTF object is created
>     with btf->nr_types capped while hdr->type_len claims more records.
> 
>   - -ENOMEM.  btf->nr_types is not incremented and the array is not
>     grown, so the next type is recorded at the slot of the dropped one
>     and btf->types[] stays off by one with respect to the type ids for
>     all remaining types.  btf_type_by_id() then returns the wrong type
>     for those ids for the whole lifetime of the object, and the last
>     type is silently left unresolved.
> 
> Propagate the error so that the object is rejected instead.
> 
> Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)")
> Signed-off-by: Feng Yang <yangfeng@kylinos.cn>

Reviewed-by: Mahe Tardy <mahe.tardy@gmail.com>

As sashiko pointed out, also makes sense in the context of this other
patch: bpf: Fix out-of-bounds btf->types write for split BTF[^1].

It seems it dates to the original introduction of this codebase with no
good reasons given the two points above listed by Feng.

[^1]: https://lore.kernel.org/bpf/20261023063133.563998-1-yangfeng59949@163.com/

> ---
>  kernel/bpf/btf.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index d870bc5e50bc..80b6f96263f1 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -5459,6 +5459,7 @@ static int btf_check_all_metas(struct btf_verifier_env *env)
>  	struct btf *btf = env->btf;
>  	struct btf_header *hdr;
>  	void *cur, *end;
> +	int err;
>  
>  	hdr = &btf->hdr;
>  	cur = btf->nohdr_data + hdr->type_off;
> @@ -5473,7 +5474,10 @@ static int btf_check_all_metas(struct btf_verifier_env *env)
>  		if (meta_size < 0)
>  			return meta_size;
>  
> -		btf_add_type(env, t);
> +		err = btf_add_type(env, t);
> +		if (err)
> +			return err;
> +
>  		cur += meta_size;
>  		env->log_type_id++;
>  	}
> -- 
> 2.25.1
> 

Re: [PATCH bpf-next] bpf: Propagate btf_add_type() errors in btf_check_all_metas()

[Alan Maguire]

On 10/23/26 5:37 PM, Mahe Tardy wrote:
> On Thu, Oct 22, 2026 at 02:47:27PM +0800, Feng Yang wrote:
>> From: Feng Yang <yangfeng@kylinos.cn>
>>
>> btf_check_all_metas() ignores the return value of btf_add_type(), so a
>> type that could not be registered is silently dropped while the loop
>> keeps walking over the type section.
>>
>> Both failure modes are reachable:
>>
>>   - -E2BIG.  Once the types array reaches its capacity (BTF_MAX_TYPE),
>>     every following btf_add_type() fails the same way, so
>>     btf_check_all_metas() still returns 0 and the BTF object is created
>>     with btf->nr_types capped while hdr->type_len claims more records.
>>
>>   - -ENOMEM.  btf->nr_types is not incremented and the array is not
>>     grown, so the next type is recorded at the slot of the dropped one
>>     and btf->types[] stays off by one with respect to the type ids for
>>     all remaining types.  btf_type_by_id() then returns the wrong type
>>     for those ids for the whole lifetime of the object, and the last
>>     type is silently left unresolved.
>>
>> Propagate the error so that the object is rejected instead.
>>
>> Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)")
>> Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
> 
> Reviewed-by: Mahe Tardy <mahe.tardy@gmail.com>
>

Acked-by: Alan Maguire <almagui@kernel.org>

Thanks for the fix! 
> As sashiko pointed out, also makes sense in the context of this other
> patch: bpf: Fix out-of-bounds btf->types write for split BTF[^1].
> 
> It seems it dates to the original introduction of this codebase with no
> good reasons given the two points above listed by Feng.
> 
> [^1]: https://lore.kernel.org/bpf/20261023063133.563998-1-yangfeng59949@163.com/
> 
>> ---
>>  kernel/bpf/btf.c | 6 +++++-
>>  1 file changed, 5 insertions(+), 1 deletion(-)
>>
>> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
>> index d870bc5e50bc..80b6f96263f1 100644
>> --- a/kernel/bpf/btf.c
>> +++ b/kernel/bpf/btf.c
>> @@ -5459,6 +5459,7 @@ static int btf_check_all_metas(struct btf_verifier_env *env)
>>  	struct btf *btf = env->btf;
>>  	struct btf_header *hdr;
>>  	void *cur, *end;
>> +	int err;
>>  
>>  	hdr = &btf->hdr;
>>  	cur = btf->nohdr_data + hdr->type_off;
>> @@ -5473,7 +5474,10 @@ static int btf_check_all_metas(struct btf_verifier_env *env)
>>  		if (meta_size < 0)
>>  			return meta_size;
>>  
>> -		btf_add_type(env, t);
>> +		err = btf_add_type(env, t);
>> +		if (err)
>> +			return err;
>> +
>>  		cur += meta_size;
>>  		env->log_type_id++;
>>  	}
>> -- 
>> 2.25.1
>>
> 

Re: [PATCH bpf-next] bpf: Propagate btf_add_type() errors in btf_check_all_metas()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Thu, 22 Oct 2026 14:47:27 +0800 you wrote:
> From: Feng Yang <yangfeng@kylinos.cn>
> 
> btf_check_all_metas() ignores the return value of btf_add_type(), so a
> type that could not be registered is silently dropped while the loop
> keeps walking over the type section.
> 
> Both failure modes are reachable:
> 
> [...]

Here is the summary with links:
  - [bpf-next] bpf: Propagate btf_add_type() errors in btf_check_all_metas()
    https://git.kernel.org/bpf/bpf/c/fb2b27d214c3

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html