Re: [PATCH bpf v2 1/2] libbpf: Fix array comparison in BTF dedup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] btf_dedup_identical_types() can enter an infinite loop when resolving cyclic modifiers due to a missing depth decrement.
--

commit 724de86c8298443100e097d1d516c73679a67fcc
Author: Mingpei CAO <caomingpei@gmail.com>

libbpf: Fix array comparison in BTF dedup

btf_dedup_identical_types() reads both array descriptors from t1,
skipping comparisons of their referenced types. This can incorrectly
merge distinct structs and corrupt CO-RE relocation metadata.

Closes: https://lore.kernel.org/bpf/CABzjXVz3iBuump-pXFkefZ5v+2uu4fG61zqRyWD4xmz3PuBycw@mail.gmail.com/

> diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
> index 8417de92d0282..41cc3140925fb 100644
> --- a/tools/lib/bpf/btf.c
> +++ b/tools/lib/bpf/btf.c
> @@ -4827,7 +4827,7 @@ static bool btf_dedup_identical_types(struct btf_dedup *d, __u32 id1, __u32 id2,
>  			return false;
>  

[Severity: High]
This is a pre-existing issue, but looking slightly above this hunk in
btf_dedup_identical_types(), can this code enter an infinite loop when
resolving cyclic modifiers?

    case BTF_KIND_TYPE_TAG:
        if (t1->info != t2->info || t1->name_off != t2->name_off)
            return false;
        id1 = t1->type;
        id2 = t2->type;
        goto recur;

The depth parameter is tracked to prevent infinite recursion on cyclic types.
However, this path uses goto recur to iteratively traverse the modifiers
without decrementing depth.

If a malformed BTF contains a cycle of modifier types (such as a TYPEDEF
that references itself), it appears depth would never decrease. Could this
lead to an infinite loop and exhaust the CPU during BTF deduplication?

>  		a1 = btf_array(t1);
> -		a2 = btf_array(t1);
> +		a2 = btf_array(t2);
>  
>  		if (a1->index_type != a2->index_type &&
>  		    !btf_dedup_identical_types(d, a1->index_type, a2->index_type, depth - 1))

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908164920.108074-1-caomingpei@gmail.com?part=1