[PATCH bpf] selftests/bpf: Add BTF repeated field count overflow test

[PATCH bpf] selftests/bpf: Add BTF repeated field count overflow test

[Paul Moses]

From 7129e266643883a4f83e65fce3ce20c7f7269fb3 Mon Sep 17 00:00:00 2001
From: Paul Moses <p@1g4.org>
Date: Tue, 9 Jun 2026 05:08:54 -0500
Subject: [PATCH bpf] selftests/bpf: Add BTF repeated field count overflow test

Add a raw BTF test that exercises repeated special-field expansion with a
large array count. The compact element layout keeps the array byte size
representable while the repeated field count overflows the old u32 capacity
calculation in btf_repeat_fields().

Signed-off-by: Paul Moses <p@1g4.org>
---
 tools/testing/selftests/bpf/prog_tests/btf.c | 37 ++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c
index 054ecb6b1e9f..9fcbc554e351 100644
--- a/tools/testing/selftests/bpf/prog_tests/btf.c
+++ b/tools/testing/selftests/bpf/prog_tests/btf.c
@@ -4258,6 +4258,43 @@ static struct btf_raw_test raw_tests[] = {
 	.max_entries = 1,
 },

+{
+	.descr = "struct test repeated fields count overflow",
+	.raw_types = {
+		BTF_TYPE_INT_ENC(NAME_TBD, BTF_INT_SIGNED, 0, 32, 4),	/* [1] */
+		BTF_STRUCT_ENC(NAME_TBD, 0, 0),				/* [2] */
+		BTF_TYPE_TAG_ENC(NAME_TBD, 2),				/* [3] */
+		BTF_PTR_ENC(3),						/* [4] */
+		BTF_TYPE_ARRAY_ENC(4, 1, 1),				/* [5] */
+		BTF_STRUCT_ENC(NAME_TBD, 10, 8),			/* [6] */
+		BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+		BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+		BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+		BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+		BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+		BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+		BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+		BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+		BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+		BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+		BTF_TYPE_ARRAY_ENC(6, 1, 0x1999999aU),			/* [7] */
+		BTF_STRUCT_ENC(NAME_TBD, 2, 8 + 8 * 0x1999999aU),	/* [8] */
+		BTF_MEMBER_ENC(NAME_TBD, 4, 0),
+		BTF_MEMBER_ENC(NAME_TBD, 7, 64),
+		BTF_END_RAW,
+	},
+	BTF_STR_SEC("\0int\0prog_test_ref_kfunc\0kptr_untrusted\0elem"
+		    "\0p0\0p1\0p2\0p3\0p4\0p5\0p6\0p7\0p8\0p9"
+		    "\0outer\0trigger\0elems"),
+	.map_type = BPF_MAP_TYPE_ARRAY,
+	.map_name = "repeat_fields",
+	.key_size = sizeof(int),
+	.value_size = 8 + 8 * 0x1999999aU,
+	.key_type_id = 1,
+	.value_type_id = 8,
+	.max_entries = 1,
+	.btf_load_err = true,
+},
 }; /* struct btf_raw_test raw_tests[] */

 static const char *get_next_str(const char *start, const char *end)
--
2.54.0

Re: [PATCH bpf] selftests/bpf: Add BTF repeated field count overflow test

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] The patch adds a selftest that intentionally triggers a 32-bit integer multiplication overflow in `btf_repeat_fields()`, but fails to include the corresponding kernel fix. Running this test will cause a massive kernel stack buffer overflow and crash the system.
--

commit c85a43a465188ee0a856395b17e0e43e08bfa15b
Author: Paul Moses <p@1g4.org>

selftests/bpf: Add BTF repeated field count overflow test

Add a raw BTF test that exercises repeated special-field expansion with a
large array count to trigger an overflow in btf_repeat_fields.

> diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c
> --- a/tools/testing/selftests/bpf/prog_tests/btf.c
> +++ b/tools/testing/selftests/bpf/prog_tests/btf.c

[ ... ]

> @@ -4258,6 +4258,43 @@ static struct btf_raw_test raw_tests[] = {
>  	.max_entries = 1,
>  },
>  
> +{
> +	.descr = "struct test repeated fields count overflow",
> +	.raw_types = {
> +		BTF_TYPE_INT_ENC(NAME_TBD, BTF_INT_SIGNED, 0, 32, 4),	/* [1] */
> +		BTF_STRUCT_ENC(NAME_TBD, 0, 0),				/* [2] */

[ ... ]

> +		BTF_MEMBER_ENC(NAME_TBD, 5, 0),
> +		BTF_MEMBER_ENC(NAME_TBD, 5, 0),
> +		BTF_TYPE_ARRAY_ENC(6, 1, 0x1999999aU),			/* [7] */

[Severity: Critical]
This isn't a bug introduced by this patch, but does adding this test without
its corresponding kernel fix deterministically crash systems running selftests?

This test intentionally triggers a 32-bit integer multiplication overflow in
kernel/bpf/btf.c:btf_repeat_fields(). The bounds check performs 32-bit
unsigned arithmetic:

kernel/bpf/btf.c:btf_repeat_fields() {
    ...
    if (field_cnt * (repeat_cnt + 1) > info_cnt)
        return -E2BIG;
    ...
}

The test crafts a BTF array of size 0x1999999a containing an internal struct
with 10 special fields. When evaluated, 10 * 0x1999999a equals 4294967300,
which wraps around to 4 in 32-bit math.

Since 4 is less than BTF_FIELDS_MAX (11), the bounds check incorrectly passes.
The loop then writes massively past the end of the stack-allocated info_arr
buffer:

kernel/bpf/btf.c:btf_repeat_fields() {
    ...
    for (i = 0; i < repeat_cnt; i++) {
        memcpy(&info[cur], &info[0], field_cnt * sizeof(info[0]));
    ...
}

Should the fix in btf_repeat_fields() be included alongside or before this
test is merged to prevent kernel panics during selftests?

> +		BTF_STRUCT_ENC(NAME_TBD, 2, 8 + 8 * 0x1999999aU),	/* [8] */
> +		BTF_MEMBER_ENC(NAME_TBD, 4, 0),
> +		BTF_MEMBER_ENC(NAME_TBD, 7, 64),
> +		BTF_END_RAW,
> +	},

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/SzebdWqm2zREZBf8Tc5Kc-JDWbh9nBztnk4PUu5kRSD1OOdr_ESVTt__2Hd3-lClr47jIjJCXfOH0RHsMpjjpEUh_R2v30nh3T1IXNT6Pbo=@1g4.org?part=1

Re: [PATCH bpf] selftests/bpf: Add BTF repeated field count overflow test

[Eduard Zingerman]

On Tue, 2026-06-09 at 11:37 +0000, Paul Moses wrote:
> From 7129e266643883a4f83e65fce3ce20c7f7269fb3 Mon Sep 17 00:00:00 2001
> From: Paul Moses <p@1g4.org>
> Date: Tue, 9 Jun 2026 05:08:54 -0500
> Subject: [PATCH bpf] selftests/bpf: Add BTF repeated field count overflow test
> 
> Add a raw BTF test that exercises repeated special-field expansion with a
> large array count. The compact element layout keeps the array byte size
> representable while the repeated field count overflows the old u32 capacity
> calculation in btf_repeat_fields().
> 
> Signed-off-by: Paul Moses <p@1g4.org>
> ---

Note that this selftest is depending on a fix:
https://lore.kernel.org/bpf/DJ4DWMO4HXCM.3NVLDGNT2704E@gmail.com/T/#t
W/o the fix KASAN warning is reported when executing the test.

Tested-by: Eduard Zingerman <eddyz87@gmail.com>
[...]

Re: [PATCH bpf] selftests/bpf: Add BTF repeated field count overflow test

[Alexei Starovoitov]

On Tue Jun 9, 2026 at 9:47 AM PDT, Eduard Zingerman wrote:
> On Tue, 2026-06-09 at 11:37 +0000, Paul Moses wrote:
>> From 7129e266643883a4f83e65fce3ce20c7f7269fb3 Mon Sep 17 00:00:00 2001
>> From: Paul Moses <p@1g4.org>
>> Date: Tue, 9 Jun 2026 05:08:54 -0500
>> Subject: [PATCH bpf] selftests/bpf: Add BTF repeated field count overflow test
>> 
>> Add a raw BTF test that exercises repeated special-field expansion with a
>> large array count. The compact element layout keeps the array byte size
>> representable while the repeated field count overflows the old u32 capacity
>> calculation in btf_repeat_fields().
>> 
>> Signed-off-by: Paul Moses <p@1g4.org>
>> ---
>
> Note that this selftest is depending on a fix:
> https://lore.kernel.org/bpf/DJ4DWMO4HXCM.3NVLDGNT2704E@gmail.com/T/#t
> W/o the fix KASAN warning is reported when executing the test.
>
> Tested-by: Eduard Zingerman <eddyz87@gmail.com>

Pls resubmit both together.

pw-bot: cr