Re: [PATCH] libbpf: check for empty BTF data section in btf_parse_elf

["Ihor Solodrai" <ihor.solodrai@linux.dev>]

On 4/9/25 5:09 AM, Mykyta Yatsenko wrote:
> On 08/04/2025 19:41, Ihor Solodrai wrote:
>> A valid ELF file may contain a SHT_NOBITS .BTF section. This case is
>> not handled correctly in btf_parse_elf, which leads to a segfault.
>>
>> Add a null check for a buffer returned by elf_getdata() before
>> proceeding with its processing.
>>
>> Bug report: https://github.com/libbpf/libbpf/issues/894
>>
>> Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
>> ---
>>   tools/lib/bpf/btf.c | 6 ++++++
>>   1 file changed, 6 insertions(+)
>>
>> diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
>> index 38bc6b14b066..90599f0311bd 100644
>> --- a/tools/lib/bpf/btf.c
>> +++ b/tools/lib/bpf/btf.c
>> @@ -1201,6 +1201,12 @@ static struct btf *btf_parse_elf(const char *path, struct btf *base_btf,
>>           goto done;
>>       }
>>   +    if (!secs.btf_data->d_buf) {
>> +        pr_warn("BTF data is empty in %s\n", path);
>> +        err = -ENODATA;
>> +        goto done;
>> +    }
>> +
>>       if (secs.btf_base_data) {
>>           dist_base_btf = btf_new(secs.btf_base_data->d_buf, secs.btf_base_data->d_size,
>>                       NULL); 
>
> is `secs.btf_data->d_size` non-zero in this case, making it access `secs.btf_data->d_buf`?

Yes, as it turns out.

This is also described in the spec in relation to Elf32_Shdr [1]:

    sh_size This member gives the section's size in bytes. Unless the section type is
    SHT_NOBITS, the section occupies sh_size bytes in the file. A section
    of type SHT_NOBITS may have a non-zero size, but it occupies no space
    in the file.

[1] https://refspecs.linuxfoundation.org/elf/elf.pdf

>
> Acked-by: Mykyta Yatsenko <mykyta.yatsenko5@gmail.com>