[PATCH bpf v3] bpf: Fix out-of-bounds btf->types write for split BTF

[PATCH bpf v3] bpf: Fix out-of-bounds btf->types write for split BTF

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

btf_add_type() stores the types of a BTF in btf->types[], which can hold at
most BTF_MAX_TYPE entries.  The types of a split BTF get IDs start_id ..
start_id + nr_types - 1, so only BTF_MAX_TYPE - start_id of them fit, but
neither the limit check nor the size used to grow the array accounts for
start_id: the check is an equality test against BTF_MAX_TYPE
('start_id + btf->types_size == BTF_MAX_TYPE') and the new size is clamped
to BTF_MAX_TYPE.

The check therefore only fires if the array happens to grow to exactly
BTF_MAX_TYPE - start_id entries.  Otherwise, if the module has more than
BTF_MAX_TYPE types, the array is filled up to BTF_MAX_TYPE entries.  The
next type that needs to be added reallocates the array to the same size,
after which btf->types_size no longer equals btf->nr_types and the growth
path is not taken anymore, so every following type is written past the end
of the array:

  BUG: unable to handle page fault for address: ffffc90006200000
  RIP: 0010:btf_add_type+0x74/0x270
  Call Trace:
   btf_check_all_metas
   btf_parse_module

Bound both the array size and the limit check by BTF_MAX_TYPE - start_id.
Base BTF (start_id == 0) is unaffected.

Fixes: 951bb64621b8 ("bpf: Add in-kernel split BTF support")
Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
Reviewed-by: Mahe Tardy <mahe.tardy@gmail.com>
---
v3: Simplify the commit message. Thanks, Ihor Solodrai.
Remove the redundant btf->start_id >= BTF_MAX_TYPE check introduced in v2.
When entering this branch, types_size == nr_types >= 0, so the condition
start_id >= BTF_MAX_TYPE is already covered by the second check.
start_id comes from btf_nr_types (base_btf), and the base BTF is subject
to the same bounds check, so start_id <= BTF_MAX_TYPE.
Thus there is no u32 wrap-around for start_id + type_size,
and max_size cannot underflow.

v2: https://lore.kernel.org/all/20261026073654.840705-1-yangfeng59949@163.com/
---
 kernel/bpf/btf.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 7ed1ff71a089..1be30487a2fa 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -1752,15 +1752,16 @@ static int btf_add_type(struct btf_verifier_env *env, struct btf_type *t)
 		/* Expand 'types' array */
 
 		struct btf_type **new_types;
-		u32 expand_by, new_size;
+		u32 expand_by, new_size, max_size;
 
-		if (btf->start_id + btf->types_size == BTF_MAX_TYPE) {
+		if (btf->start_id + btf->types_size >= BTF_MAX_TYPE) {
 			btf_verifier_log(env, "Exceeded max num of types");
 			return -E2BIG;
 		}
 
+		max_size = BTF_MAX_TYPE - btf->start_id;
 		expand_by = max_t(u32, btf->types_size >> 2, 16);
-		new_size = min_t(u32, BTF_MAX_TYPE,
+		new_size = min_t(u32, max_size,
 				 btf->types_size + expand_by);
 
 		new_types = kvzalloc_objs(*new_types, new_size,
-- 
2.25.1

Re: [PATCH bpf v3] bpf: Fix out-of-bounds btf->types write for split BTF

[Ihor Solodrai]

On 10/27/26 8:19 PM, Feng Yang wrote:
> From: Feng Yang <yangfeng@kylinos.cn>
> 
> btf_add_type() stores the types of a BTF in btf->types[], which can hold at
> most BTF_MAX_TYPE entries.  The types of a split BTF get IDs start_id ..
> start_id + nr_types - 1, so only BTF_MAX_TYPE - start_id of them fit, but
> neither the limit check nor the size used to grow the array accounts for
> start_id: the check is an equality test against BTF_MAX_TYPE
> ('start_id + btf->types_size == BTF_MAX_TYPE') and the new size is clamped
> to BTF_MAX_TYPE.
> 
> The check therefore only fires if the array happens to grow to exactly
> BTF_MAX_TYPE - start_id entries.  Otherwise, if the module has more than
> BTF_MAX_TYPE types, the array is filled up to BTF_MAX_TYPE entries.  The
> next type that needs to be added reallocates the array to the same size,
> after which btf->types_size no longer equals btf->nr_types and the growth
> path is not taken anymore, so every following type is written past the end
> of the array:
> 
>   BUG: unable to handle page fault for address: ffffc90006200000
>   RIP: 0010:btf_add_type+0x74/0x270
>   Call Trace:
>    btf_check_all_metas
>    btf_parse_module
> 
> Bound both the array size and the limit check by BTF_MAX_TYPE - start_id.
> Base BTF (start_id == 0) is unaffected.
> 
> Fixes: 951bb64621b8 ("bpf: Add in-kernel split BTF support")
> Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
> Reviewed-by: Mahe Tardy <mahe.tardy@gmail.com>

Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev>

Thank you!

> ---
> v3: Simplify the commit message. Thanks, Ihor Solodrai.
> Remove the redundant btf->start_id >= BTF_MAX_TYPE check introduced in v2.
> When entering this branch, types_size == nr_types >= 0, so the condition
> start_id >= BTF_MAX_TYPE is already covered by the second check.
> start_id comes from btf_nr_types (base_btf), and the base BTF is subject
> to the same bounds check, so start_id <= BTF_MAX_TYPE.
> Thus there is no u32 wrap-around for start_id + type_size,
> and max_size cannot underflow.
> 
> v2: https://lore.kernel.org/all/20261026073654.840705-1-yangfeng59949@163.com/
> ---
>  kernel/bpf/btf.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 7ed1ff71a089..1be30487a2fa 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -1752,15 +1752,16 @@ static int btf_add_type(struct btf_verifier_env *env, struct btf_type *t)
>  		/* Expand 'types' array */
>  
>  		struct btf_type **new_types;
> -		u32 expand_by, new_size;
> +		u32 expand_by, new_size, max_size;
>  
> -		if (btf->start_id + btf->types_size == BTF_MAX_TYPE) {
> +		if (btf->start_id + btf->types_size >= BTF_MAX_TYPE) {
>  			btf_verifier_log(env, "Exceeded max num of types");
>  			return -E2BIG;
>  		}
>  
> +		max_size = BTF_MAX_TYPE - btf->start_id;
>  		expand_by = max_t(u32, btf->types_size >> 2, 16);
> -		new_size = min_t(u32, BTF_MAX_TYPE,
> +		new_size = min_t(u32, max_size,
>  				 btf->types_size + expand_by);
>  
>  		new_types = kvzalloc_objs(*new_types, new_size,

Re: [PATCH bpf v3] bpf: Fix out-of-bounds btf->types write for split BTF

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Wed, 28 Oct 2026 11:19:33 +0800 you wrote:
> From: Feng Yang <yangfeng@kylinos.cn>
> 
> btf_add_type() stores the types of a BTF in btf->types[], which can hold at
> most BTF_MAX_TYPE entries.  The types of a split BTF get IDs start_id ..
> start_id + nr_types - 1, so only BTF_MAX_TYPE - start_id of them fit, but
> neither the limit check nor the size used to grow the array accounts for
> start_id: the check is an equality test against BTF_MAX_TYPE
> ('start_id + btf->types_size == BTF_MAX_TYPE') and the new size is clamped
> to BTF_MAX_TYPE.
> 
> [...]

Here is the summary with links:
  - [bpf,v3] bpf: Fix out-of-bounds btf->types write for split BTF
    https://git.kernel.org/bpf/bpf/c/6c476d2b7305

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html