Re: [PATCH bpf-next v3 4/6] bpftool: Cover loader metadata with the program signature

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] The return value of EVP_Digest() is ignored, meaning that if the digest computation fails, uninitialized stack memory is embedded as the excl_prog_hash in the generated C skeleton.
--

commit e281b7d5ac70a49b622a3d4044b8e6f8e9dd90d4
Author: Daniel Borkmann <daniel@iogearbox.net>

bpftool: Cover loader metadata with the program signature

This commit updates bpftool's program signing logic to include loader
metadata alongside instructions. The signed artifact now embeds both in
the generated skeleton, allowing offline signature validation.

Link: https://lore.kernel.org/lkml/ecf0521ed302db672672ebfbc670ecfba36a6e00.camel@HansenPartnership.com [0]

> diff --git a/tools/bpf/bpftool/sign.c b/tools/bpf/bpftool/sign.c
> index f9b742f4bb104..7cc991c69dc2c 100644
> --- a/tools/bpf/bpftool/sign.c
> +++ b/tools/bpf/bpftool/sign.c
[ ... ]
> @@ -178,7 +190,7 @@ int bpftool_prog_sign(struct bpf_load_and_run_opts *opts)
>  	EVP_Digest(opts->insns, opts->insns_sz, opts->excl_prog_hash,
>  		   &opts->excl_prog_hash_sz, EVP_sha256(), NULL);

[Severity: Medium]
This is a pre-existing issue, but should we check the return value of
EVP_Digest() here?

If EVP_Digest() fails (for example, due to an OpenSSL internal error or
memory allocation failure), it returns 0 and leaves the hash uncomputed.

When called from gen_trace() in tools/bpf/bpftool/gen.c, this would result
in an uninitialized stack buffer (prog_sha) being written to the generated
C skeleton file as excl_prog_hash. This could leak build-time tool stack
memory into the generated code and cause the program signature validation
to fail when loaded.

>  
> -		bd_out = BIO_new(BIO_s_mem());
> +	bd_out = BIO_new(BIO_s_mem());
>  	if (!bd_out) {
>  		err = -ENOMEM;
>  		goto cleanup;
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702143605.252797-1-daniel@iogearbox.net?part=4