Re: [PATCH bpf-next v9 16/23] libbpf: Add cleanup_info to bpf_prog_load_opts

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: libbpf misaligned cleanup_info read during verifier log retry
--

commit 44e841423bd633c0b2885ef9ad198f15d3871fba
Author: Yonghong Song <yonghong.song@linux.dev>

libbpf: Add cleanup_info to bpf_prog_load_opts

This commit adds cleanup_info fields to bpf_prog_load_opts to allow
callers to pass an exception cleanup table to the kernel during program load.
The new fields are propagated to union bpf_attr for the BPF_PROG_LOAD syscall.

> diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
> index b49822d212aed..b4031f62bdee5 100644
> --- a/tools/lib/bpf/bpf.c
> +++ b/tools/lib/bpf/bpf.c
[ ... ]
> @@ -370,6 +370,10 @@ int bpf_prog_load(enum bpf_prog_type prog_type,
>  	attr.fd_array = ptr_to_u64(OPTS_GET(opts, fd_array, NULL));
>  	attr.fd_array_cnt = OPTS_GET(opts, fd_array_cnt, 0);
>  
> +	attr.cleanup_info = ptr_to_u64(OPTS_GET(opts, cleanup_info, NULL));
> +	attr.cleanup_info_rec_size = OPTS_GET(opts, cleanup_info_rec_size, 0);
> +	attr.cleanup_info_cnt = OPTS_GET(opts, cleanup_info_cnt, 0);
> +

[Severity: Medium]
If the first sys_bpf_prog_load() fails with -E2BIG, the kernel can mutate
attr.cleanup_info_rec_size to a smaller size.

During the verifier log retry block later in bpf_prog_load():

	if (log_level == 0 && log_buf) {
		...
		attr.log_level = 1;
		fd = sys_bpf_prog_load(&attr, attr_sz, attempts);

If attr.cleanup_info_rec_size was mutated, the retry uses the smaller size
while attr.cleanup_info still points to the user's original array with the
larger stride.

Does this cause the kernel to perform misaligned reads starting from the
second record and parse garbage exception info?

>  	if (log_level) {
>  		attr.log_buf = ptr_to_u64(log_buf);
>  		attr.log_size = log_size;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008074959.2993751-1-yonghong.song@linux.dev?part=16