Re: [PATCH bpf-next v4 2/7] libbpf: BPF programs manual loading and attaching

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: bpf_program__load() allows loading from failed object, causing Use-After-Close
--

commit 62d928e64d7108c312cff920bafa876c284cb8bd
Author: Slava Imameev <slava.imameev@crowdstrike.com>

libbpf: BPF programs manual loading and attaching

BPF programs designated as manually loaded can be loaded and attached
independently after the initial bpf_object loading and attaching. This
patch adds bpf_program__load() to support loading these manual-strategy
programs independently.

> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index a3085847cb97f..939f0d6378e38 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c

[ ... ]

> @@ -9233,7 +9286,7 @@ static int bpf_object_load(struct bpf_object *obj, int extra_log_level, const ch
>  			err = bpf_gen__finish(obj->gen_loader, obj->nr_programs, obj->nr_maps);
>  	}
>  
> -	bpf_object_post_load_cleanup(obj);
> +	bpf_object_post_load_cleanup(obj, false);
>  	obj->state = OBJ_LOADED; /* doesn't matter if successfully or not */
>  
>  	if (err) {

[Severity: High]
Could this state assignment allow dangerous program loads if
bpf_object_load() fails?

When bpf_object_load() fails after bpf_object_prepare(), it falls through to
error handling which calls bpf_object_unload() and closes the map FDs.
However, the state is still unconditionally set to OBJ_LOADED.

[ ... ]

> @@ -15386,3 +15501,34 @@ enum bpf_prog_load_strategy bpf_program__load_strategy(const struct bpf_program
>  {
>  	return prog->load_strategy;
>  }
> +
> +/*
> + * This function must be called after bpf_object__prepare (or
> + * bpf_object__load, which calls bpf_object__prepare internally).
> + * Manually-loaded program data is initialized on object prepare.
> + * Post-prepare initialization is not supported.
> + */
> +int
> +bpf_program__load(struct bpf_program *prog)
> +{
> +	int err;
> +	struct bpf_object *obj = prog->obj;
> +
> +	if (obj->state < OBJ_PREPARED)
> +		return libbpf_err(-EINVAL);

[Severity: High]
Is this state check sufficient to prevent a use-after-close if the underlying
object failed to load?

If an application ignores a prior bpf_object_load() error and calls
bpf_program__load(), this check will pass because the failed object is now in
the OBJ_LOADED state (which is >= OBJ_PREPARED).

Because the failure triggered bpf_object_unload(), the map FDs were closed,
allowing bpf_program__load() to proceed with stale map FDs.

If a map FD is reused, the kernel might attach the BPF program to an
unrelated map, causing data corruption or security boundary violations.
For programs with BTF, the kernel rejects the load with -EFAULT because
func_info is freed but func_info_cnt remains > 0. For programs without BTF,
the kernel proceeds using the stale FDs.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921223937.3203093-1-andrey.grodzovsky@crowdstrike.com?part=2