libbpf: Move arena globals to the end of the arena

Arena globals are currently placed at the beginning of the arena
by libbpf. This is convenient, but prevents users from reserving
guard pages in the beginning of the arena to identify NULL pointer
dereferences. Adjust the load logic to place the globals at the
end of the arena instead.

Also modify bpftool to set the arena pointer in the program's BPF
skeleton to point to the globals. Users now call bpf_map__initial_value()
to find the beginning of the arena mapping and use the arena pointer
in the skeleton to determine which part of the mapping holds the
arena globals and which part is free.

Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20251216173325.98465-5-emil@etsalapatis.com

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 4d4badb64824849874ac6a7ec48177a7fb8f267f..6fba879492a889475d51d24ac7ec9c46cc042d24 100644 (file)
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -757,6 +757,7 @@ struct bpf_object {
        int arena_map_idx;
        void *arena_data;
        size_t arena_data_sz;
+       size_t arena_data_off;
 
        void *jumptables_data;
        size_t jumptables_data_sz;
@@ -2991,10 +2992,11 @@ static int init_arena_map_data(struct bpf_object *obj, struct bpf_map *map,
                               void *data, size_t data_sz)
 {
        const long page_sz = sysconf(_SC_PAGE_SIZE);
+       const size_t data_alloc_sz = roundup(data_sz, page_sz);
        size_t mmap_sz;
 
        mmap_sz = bpf_map_mmap_sz(map);
-       if (roundup(data_sz, page_sz) > mmap_sz) {
+       if (data_alloc_sz > mmap_sz) {
                pr_warn("elf: sec '%s': declared ARENA map size (%zu) is too small to hold global __arena variables of size %zu\n",
                        sec_name, mmap_sz, data_sz);
                return -E2BIG;
@@ -3006,6 +3008,9 @@ static int init_arena_map_data(struct bpf_object *obj, struct bpf_map *map,
        memcpy(obj->arena_data, data, data_sz);
        obj->arena_data_sz = data_sz;
 
+       /* place globals at the end of the arena */
+       obj->arena_data_off = mmap_sz - data_alloc_sz;
+
        /* make bpf_map__init_value() work for ARENA maps */
        map->mmaped = obj->arena_data;
 
@@ -4663,7 +4668,7 @@ static int bpf_program__record_reloc(struct bpf_program *prog,
                reloc_desc->type = RELO_DATA;
                reloc_desc->insn_idx = insn_idx;
                reloc_desc->map_idx = obj->arena_map_idx;
-               reloc_desc->sym_off = sym->st_value;
+               reloc_desc->sym_off = sym->st_value + obj->arena_data_off;
 
                map = &obj->maps[obj->arena_map_idx];
                pr_debug("prog '%s': found arena map %d (%s, sec %d, off %zu) for insn %u\n",
@@ -5624,7 +5629,8 @@ retry:
                                        return err;
                                }
                                if (obj->arena_data) {
-                                       memcpy(map->mmaped, obj->arena_data, obj->arena_data_sz);
+                                       memcpy(map->mmaped + obj->arena_data_off, obj->arena_data,
+                                               obj->arena_data_sz);
                                        zfree(&obj->arena_data);
                                }
                        }
@@ -14429,7 +14435,10 @@ int bpf_object__load_skeleton(struct bpf_object_skeleton *s)
                if (!map_skel->mmaped)
                        continue;
 
-               *map_skel->mmaped = map->mmaped;
+               if (map->def.type == BPF_MAP_TYPE_ARENA)
+                       *map_skel->mmaped = map->mmaped + map->obj->arena_data_off;
+               else
+                       *map_skel->mmaped = map->mmaped;
        }
 
        return 0;

diff --git a/tools/testing/selftests/bpf/progs/verifier_arena_large.c b/tools/testing/selftests/bpf/progs/verifier_arena_large.c
index bd430a34c3ab4d1f48cb5afbdb3321ac4a2b9dcc..2b8cf2a4d8808586d09c4e6cc32e60cc977ff354 100644 (file)
--- a/tools/testing/selftests/bpf/progs/verifier_arena_large.c
+++ b/tools/testing/selftests/bpf/progs/verifier_arena_large.c
@@ -31,16 +31,22 @@ int big_alloc1(void *ctx)
        if (!page1)
                return 1;
 
-       /* Account for global arena data. */
-       if ((u64)page1 != base + PAGE_SIZE)
+       if ((u64)page1 != base)
                return 15;
 
        *page1 = 1;
-       page2 = bpf_arena_alloc_pages(&arena, (void __arena *)(ARENA_SIZE - PAGE_SIZE),
+       page2 = bpf_arena_alloc_pages(&arena, (void __arena *)(ARENA_SIZE - 2 * PAGE_SIZE),
                                      1, NUMA_NO_NODE, 0);
        if (!page2)
                return 2;
        *page2 = 2;
+
+       /* Test for the guard region at the end of the arena. */
+       no_page = bpf_arena_alloc_pages(&arena, (void __arena *)ARENA_SIZE - PAGE_SIZE,
+                                       1, NUMA_NO_NODE, 0);
+       if (no_page)
+               return 16;
+
        no_page = bpf_arena_alloc_pages(&arena, (void __arena *)ARENA_SIZE,
                                        1, NUMA_NO_NODE, 0);
        if (no_page)