Re: [PATCH v4 bpf-next 4/7] btf: Preserve string relocation maps for split BTF

On 09/10/2026 13:01, sashiko-bot@kernel.org wrote:

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [High] btf: memory corruption and invalid string offsets with split base BTF
- [High] bpf: heap buffer overflow in btf_relocate_map_distilled_base() on split BTF
- [Medium] libbpf: NULL pointer dereference in btf_relocate() when btf has no base
- [Low] bpf: btf_relocate_rewrite_strs prints empty string in warning
--

commit 5e8ac630aea03f4aa4b3a237792c60ad3c7a0956
Author: Alan Maguire [off-list ref]

btf: Preserve string relocation maps for split BTF

Make btf_relocate() optionally return the string-offset map it builds
while relocating a BTF relative to a distilled base. A subsequent split
BTF object can use that map to rebase references to base strings.

Also account for the accumulated base string offset when assigning a
new BTF base. This is required when the base is itself split.

quoted

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 592b71a838410..22dd123450c3e 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c

@@ -1936,7 +1936,7 @@ void btf_set_base_btf(struct btf *btf, const struct btf *base_btf)
 {
 	btf->base_btf = (struct btf *)base_btf;
 	btf->start_id = btf_nr_types(base_btf);
-	btf->start_str_off = base_btf->hdr.str_len;
+	btf->start_str_off = base_btf->start_str_off + base_btf->hdr.str_len;
 }

[Severity: High]
Since this allows using a split BTF as the base, will it cause out-of-bounds
heap writes in tools/lib/bpf/btf_relocate.c:btf_relocate_map_distilled_base()?

It is technically true that if we used split BTF as the basis for a distilled
.BTF.base, the string offset would be a problem. However we never do.
The reason .BTF.base exists is because we want a way to create stable base
BTF references for split BTF after potential base vmlinux changes.