Re: [PATCH bpf-next v9 16/23] libbpf: Add cleanup_info to bpf_prog_load_opts

[Yonghong Song <yonghong.song@linux.dev>]

On 10/8/26 10:12 AM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] bpf: libbpf misaligned cleanup_info read during verifier log retry
> --
>
> commit 44e841423bd633c0b2885ef9ad198f15d3871fba
> Author: Yonghong Song <yonghong.song@linux.dev>
>
> libbpf: Add cleanup_info to bpf_prog_load_opts
>
> This commit adds cleanup_info fields to bpf_prog_load_opts to allow
> callers to pass an exception cleanup table to the kernel during program load.
> The new fields are propagated to union bpf_attr for the BPF_PROG_LOAD syscall.
>
>> diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
>> index b49822d212aed..b4031f62bdee5 100644
>> --- a/tools/lib/bpf/bpf.c
>> +++ b/tools/lib/bpf/bpf.c
> [ ... ]
>> @@ -370,6 +370,10 @@ int bpf_prog_load(enum bpf_prog_type prog_type,
>>   	attr.fd_array = ptr_to_u64(OPTS_GET(opts, fd_array, NULL));
>>   	attr.fd_array_cnt = OPTS_GET(opts, fd_array_cnt, 0);
>>   
>> +	attr.cleanup_info = ptr_to_u64(OPTS_GET(opts, cleanup_info, NULL));
>> +	attr.cleanup_info_rec_size = OPTS_GET(opts, cleanup_info_rec_size, 0);
>> +	attr.cleanup_info_cnt = OPTS_GET(opts, cleanup_info_cnt, 0);
>> +
> [Severity: Medium]
> If the first sys_bpf_prog_load() fails with -E2BIG, the kernel can mutate
> attr.cleanup_info_rec_size to a smaller size.
>
> During the verifier log retry block later in bpf_prog_load():
>
> 	if (log_level == 0 && log_buf) {
> 		...
> 		attr.log_level = 1;
> 		fd = sys_bpf_prog_load(&attr, attr_sz, attempts);
>
> If attr.cleanup_info_rec_size was mutated, the retry uses the smaller size
> while attr.cleanup_info still points to the user's original array with the
> larger stride.
>
> Does this cause the kernel to perform misaligned reads starting from the
> second record and parse garbage exception info?

This is the first time we introduced cleanup_info_rec_size. There is no
need to retry by changing attr.cleanup_info_rec_size. If users have
a bigger cleanup_info_rec_size and causing -E2BIG, it is users' problem.

>
>>   	if (log_level) {
>>   		attr.log_buf = ptr_to_u64(log_buf);
>>   		attr.log_size = log_size;