Re: [PATCH bpf-next 09/14] bpf: Allow a variable in DATASEC that is smaller than its type

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpftool/perf: out-of-bounds heap read when dumping DATASEC variables
--

commit 1b453d08464afcede36a667c89c48e99ef1d651d
Author: Alexei Starovoitov <ast@kernel.org>

bpf: Allow a variable in DATASEC that is smaller than its type
    
LLVM splits a static of a Rust program into pieces. Every piece is a VAR
with the type of the whole static:
    
  [223] STRUCT 'BpfCell<core::option::Option<...>>' size=32 vlen=1
  [236] VAR '..scx_cosmos9TASK_CTXS.0' type_id=223, linkage=static
  [248] DATASEC '.bss' size=0 vlen=9
          type_id=236 offset=24648 size=1 (VAR '..TASK_CTXS.0')
    
and the kernel rejects such BTF with "Invalid size". Allow it.

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index c9d4b709380c9..0630675377aaa 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
[ ... ]
> @@ -5412,16 +5412,16 @@ static int btf_datasec_resolve(struct btf_verifier_env *env,
>  			return env_stack_push(env, var_type, var_type_id);
>  		}
>  
> +		/*
> +		 * The variable can be smaller than its type. It's a piece of
> +		 * a variable that the compiler split then, with the type of
> +		 * the whole variable.
> +		 */
>  		type_id = var_type->type;
> -		if (!btf_type_id_size(btf, &type_id, &type_size)) {
> +		if (!btf_type_id_size(btf, &type_id, NULL)) {
>  			btf_verifier_log_vsi(env, v->t, vsi, "Invalid type");
>  			return -EINVAL;
>  		}
> -
> -		if (vsi->size < type_size) {
> -			btf_verifier_log_vsi(env, v->t, vsi, "Invalid size");
> -			return -EINVAL;
> -		}

[Severity: Medium]
Does removing this validation expose userspace tools to out-of-bounds heap
reads?

By allowing vsi->size < type_size, a DATASEC variable piece's offset plus its
full type size can now exceed the DATASEC's total size.

When bpftool dumps a DATASEC:

tools/bpf/bpftool/btf_dumper.c:btf_dumper_datasec() {
    ...
    ret = btf_dumper_do_type(d, vsi[i].type, 0, data + vsi[i].offset);
    ...
}

It unconditionally reads bytes based on the variable's full type size. Since
the piece is smaller than its type, this reads past the end of the allocated
map value buffer.

Similarly, perf passes the full type size as the bounding data_sz to libbpf:

tools/perf/util/bpf-event.c:format_btf_variable() {
    ...
    btf_size = btf__resolve_size(btf, t->type);
    btf_dump__dump_type_data(d, t->type, btf_data, btf_size, &opts);
    ...
}

This incorrectly bypasses libbpf's internal bounds checks, causing libbpf
to read out-of-bounds from map->rodata.

>  	}
>  
>  	env_stack_pop_resolved(env, 0, 0);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930193127.2181684-1-alexei.starovoitov@gmail.com?part=9