Re: [PATCH v4 bpf-next 4/7] btf: Preserve string relocation maps for split BTF

[Alan Maguire <alan.maguire@oracle.com>]

On 09/10/2026 13:01, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
> - [High] btf: memory corruption and invalid string offsets with split base BTF
> - [High] bpf: heap buffer overflow in btf_relocate_map_distilled_base() on split BTF
> - [Medium] libbpf: NULL pointer dereference in btf_relocate() when btf has no base
> - [Low] bpf: btf_relocate_rewrite_strs prints empty string in warning
> --
> 
> commit 5e8ac630aea03f4aa4b3a237792c60ad3c7a0956
> Author: Alan Maguire <alan.maguire@oracle.com>
> 
> btf: Preserve string relocation maps for split BTF
> 
> Make btf_relocate() optionally return the string-offset map it builds
> while relocating a BTF relative to a distilled base. A subsequent split
> BTF object can use that map to rebase references to base strings.
> 
> Also account for the accumulated base string offset when assigning a
> new BTF base. This is required when the base is itself split.
> 
>> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
>> index 592b71a838410..22dd123450c3e 100644
>> --- a/kernel/bpf/btf.c
>> +++ b/kernel/bpf/btf.c
>> @@ -1936,7 +1936,7 @@ void btf_set_base_btf(struct btf *btf, const struct btf *base_btf)
>>  {
>>  	btf->base_btf = (struct btf *)base_btf;
>>  	btf->start_id = btf_nr_types(base_btf);
>> -	btf->start_str_off = base_btf->hdr.str_len;
>> +	btf->start_str_off = base_btf->start_str_off + base_btf->hdr.str_len;
>>  }
> 
> [Severity: High]
> Since this allows using a split BTF as the base, will it cause out-of-bounds
> heap writes in tools/lib/bpf/btf_relocate.c:btf_relocate_map_distilled_base()?
> 

It is technically true that if we used split BTF as the basis for a distilled
.BTF.base, the string offset would be a problem. However we never do.
The reason .BTF.base exists is because we want a way to create stable base
BTF references for split BTF after potential base vmlinux changes.