Re: [PATCH bpf-next] bpf: Propagate btf_add_type() errors in btf_check_all_metas()

[Mahe Tardy <mahe.tardy@gmail.com>]

On Thu, Oct 22, 2026 at 02:47:27PM +0800, Feng Yang wrote:
> From: Feng Yang <yangfeng@kylinos.cn>
> 
> btf_check_all_metas() ignores the return value of btf_add_type(), so a
> type that could not be registered is silently dropped while the loop
> keeps walking over the type section.
> 
> Both failure modes are reachable:
> 
>   - -E2BIG.  Once the types array reaches its capacity (BTF_MAX_TYPE),
>     every following btf_add_type() fails the same way, so
>     btf_check_all_metas() still returns 0 and the BTF object is created
>     with btf->nr_types capped while hdr->type_len claims more records.
> 
>   - -ENOMEM.  btf->nr_types is not incremented and the array is not
>     grown, so the next type is recorded at the slot of the dropped one
>     and btf->types[] stays off by one with respect to the type ids for
>     all remaining types.  btf_type_by_id() then returns the wrong type
>     for those ids for the whole lifetime of the object, and the last
>     type is silently left unresolved.
> 
> Propagate the error so that the object is rejected instead.
> 
> Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)")
> Signed-off-by: Feng Yang <yangfeng@kylinos.cn>

Reviewed-by: Mahe Tardy <mahe.tardy@gmail.com>

As sashiko pointed out, also makes sense in the context of this other
patch: bpf: Fix out-of-bounds btf->types write for split BTF[^1].

It seems it dates to the original introduction of this codebase with no
good reasons given the two points above listed by Feng.

[^1]: https://lore.kernel.org/bpf/20261023063133.563998-1-yangfeng59949@163.com/

> ---
>  kernel/bpf/btf.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index d870bc5e50bc..80b6f96263f1 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -5459,6 +5459,7 @@ static int btf_check_all_metas(struct btf_verifier_env *env)
>  	struct btf *btf = env->btf;
>  	struct btf_header *hdr;
>  	void *cur, *end;
> +	int err;
>  
>  	hdr = &btf->hdr;
>  	cur = btf->nohdr_data + hdr->type_off;
> @@ -5473,7 +5474,10 @@ static int btf_check_all_metas(struct btf_verifier_env *env)
>  		if (meta_size < 0)
>  			return meta_size;
>  
> -		btf_add_type(env, t);
> +		err = btf_add_type(env, t);
> +		if (err)
> +			return err;
> +
>  		cur += meta_size;
>  		env->log_type_id++;
>  	}
> -- 
> 2.25.1
>