Re: [PATCH bpf-next] libbpf: defer arena map size check to load time

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] NULL pointer dereference in init_arena_map_data() when processing a SHT_NOBITS .arena section.
--

commit 839c80f912fa6d6c52eb18408dfd0437488f602b
Author: Mykyta Yatsenko <yatsenko@meta.com>

libbpf: defer arena map size check to load time

init_arena_map_data() used the build-host page size while it opened an
object. This could reject skeleton generation when the build host and
target use different page sizes.

> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index c036e8a91ed88..413b8b305194e 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c

[ ... ]

> @@ -3107,8 +3095,7 @@ static int bpf_object__init_user_btf_maps(struct bpf_object *obj, bool strict,
>  		obj->arena_map_idx = i;
>  
>  		if (obj->efile.arena_data) {
> -			err = init_arena_map_data(obj, map, ARENA_SEC, obj->efile.arena_data_shndx,
> -						  obj->efile.arena_data->d_buf,
> +			err = init_arena_map_data(obj, map, obj->efile.arena_data->d_buf,
>  						  obj->efile.arena_data->d_size);

[Severity: High]
This isn't a bug introduced by this patch, but can we pass a NULL pointer to
init_arena_map_data() here?

If the ELF section is of type SHT_NOBITS with a non-zero size, elf_getdata()
can return an Elf_Data structure where d_buf is NULL but d_size is non-zero.

In that case, bpf_object__init_user_btf_maps() passes a NULL data pointer
to init_arena_map_data(), which then executes:

tools/lib/bpf/libbpf.c:init_arena_map_data() {
    ...
	memcpy(obj->arena_data, data, data_sz);
    ...
}

leading to a NULL pointer dereference. Could we validate that d_buf is not
NULL before calling memcpy, or handle SHT_NOBITS sections differently?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908-libbpf_arena_thing-v1-1-0092c0e0d91b@meta.com?part=1