Re: [PATCH 5.10-6.18] libbpf: fix cross-endian build with newer libbpf

[Dominique Martinet <asmadeus@codewreck.org>]

sashiko-bot@kernel.org wrote on Sun, Nov 15, 2026 at 08:23:16PM +0000:
> > Link: https://github.com/NixOS/nixpkgs/pull/570639
> > Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
> 
> [Severity: Low]
> Should this include a Fixes tag for the commit that introduced the strict
> swapped-endian header size check:
> 
>   Fixes: 3289959b97ca ("libbpf: Support BTF loading and raw data output in both endianness")

Err, yeah, I guess that bug couldn't happen before support for
endianness was added, but it didn't work before either so meh :)
Feel free to add when applying if you think it helps.

> > diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
> > index 231b07203e3d2..8f3f942eda704 100644
> > --- a/tools/lib/bpf/btf.c
> > +++ b/tools/lib/bpf/btf.c
> > @@ -198,7 +198,7 @@ static int btf_parse_hdr(struct btf *btf)
> >  
> >  	if (hdr->magic == bswap_16(BTF_MAGIC)) {
> >  		btf->swapped_endian = true;
> > -		if (bswap_32(hdr->hdr_len) != sizeof(struct btf_header)) {
> > +		if (bswap_32(hdr->hdr_len) < sizeof(struct btf_header)) {
> >  			pr_warn("Can't load BTF with non-native endianness due to unsupported header length %u\n",
> >  				bswap_32(hdr->hdr_len));
> >  			return -ENOTSUP;
> 
> [Severity: Low]
> Can relaxing this check cause out-of-bounds reads and writes on
> btf->raw_data when parsing a malformed cross-endian BTF buffer with
> hdr->hdr_len > sizeof(*hdr)?
> 
> Previously, requiring hdr->hdr_len == sizeof(struct btf_header) together
> with btf->raw_size >= sizeof(struct btf_header) guaranteed hdr->hdr_len
> fit within btf->raw_size.  btf_parse_hdr() still computes meta_left from
> sizeof(*hdr) instead of hdr->hdr_len:
> 
> tools/lib/bpf/btf.c:btf_parse_hdr() {
> 	...
> 	meta_left = btf->raw_size - sizeof(*hdr);
> Sashiko AI review · https://sashiko.dev/#/patchset/20261115200505.1494710-2-asmadeus@codewreck.org?part=1

sashiko apparently picked the v5.10 tag, but this bad sizeof was fixed
in commit c825f5fee19c ("libbpf: Fix BTF header parsing checks") and
isn't a problem as far as I can tell (that commit was backported to all
stable kernels, and header is properly used, after endianness swap)

Thanks,
-- 
Dominique Martinet | Asmadeus