[PATCH bpf-next v2] libbpf: Fix stale raw data after btf__relocate()

[PATCH bpf-next v2] libbpf: Fix stale raw data after btf__relocate()

[Jiayuan Chen]

btf_relocate() rewrites type ids in place but doesn't drop the cached
raw_data, so btf__raw_data() after btf__relocate() returns the old
bytes with pre-relocation ids.

Only modifiable BTF keeps raw_data as a cache. For read-only BTF, e.g.
module BTF relocated in btf_parse_elf(), types_data points into
raw_data and is already rewritten in place, so it must not be freed.
Make btf_invalidate_raw_data() tell the two apart and call it from
btf__relocate(). Also recompute named_start_id since start_id changes
after relocation, like the kernel does.

Fixes: 19e00c897d50 ("libbpf: Split BTF relocation")
Reported-by: 洛 <wanghai8081@gmail.com>
Closes: https://lore.kernel.org/bpf/455f7257-25b9-4070-8313-42af8005b948@linux.dev/T/#t
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
v2:
 - Free raw_data only for modifiable BTF and call btf_invalidate_raw_data()
   from btf__relocate() instead of btf_ensure_modifiable(), per Alexei
 - Recompute named_start_id after relocation
 - Drop the selftest since it is contrived, as Alexei pointed out
 - Target bpf-next
v1: https://lore.kernel.org/bpf/20261101155615.324501-1-jiayuan.chen@linux.dev/
---
 tools/lib/bpf/btf.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index d2ff6f5d6d5b..d67f78d76750 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -2033,7 +2033,8 @@ struct btf *btf__load_from_kernel_by_id(__u32 id)
 
 static void btf_invalidate_raw_data(struct btf *btf)
 {
-	if (btf->raw_data)
+	/* types_data and strs_data of read-only BTF point into raw_data */
+	if (btf->raw_data && btf_is_modifiable(btf))
 		btf_free_raw_data(btf);
 	if (btf->raw_data_swapped) {
 		free(btf->raw_data_swapped);
@@ -2099,11 +2100,11 @@ static int btf_ensure_modifiable(struct btf *btf)
 	if (!btf->base_btf && btf->hdr.str_len == 1)
 		btf->strs_deduped = true;
 
+	btf->modifiable = true;
+
 	/* invalidate raw_data representation */
 	btf_invalidate_raw_data(btf);
 
-	btf->modifiable = true;
-
 	return 0;
 
 err_out:
@@ -6642,8 +6643,12 @@ int btf__relocate(struct btf *btf, const struct btf *base_btf)
 {
 	int err = btf_relocate(btf, base_btf, NULL, NULL);
 
-	if (!err)
+	/* types are rewritten in place, some of them even on error */
+	btf_invalidate_raw_data(btf);
+	if (!err) {
 		btf->owns_base = false;
+		btf_check_sorted(btf);
+	}
 	return libbpf_err(err);
 }
 
-- 
2.43.0

Re: [PATCH bpf-next v2] libbpf: Fix stale raw data after btf__relocate()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Tue,  3 Nov 2026 16:18:35 +0800 you wrote:
> btf_relocate() rewrites type ids in place but doesn't drop the cached
> raw_data, so btf__raw_data() after btf__relocate() returns the old
> bytes with pre-relocation ids.
> 
> Only modifiable BTF keeps raw_data as a cache. For read-only BTF, e.g.
> module BTF relocated in btf_parse_elf(), types_data points into
> raw_data and is already rewritten in place, so it must not be freed.
> Make btf_invalidate_raw_data() tell the two apart and call it from
> btf__relocate(). Also recompute named_start_id since start_id changes
> after relocation, like the kernel does.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v2] libbpf: Fix stale raw data after btf__relocate()
    https://git.kernel.org/bpf/bpf-next/c/b2bb14d8035d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html