Bpftool sync 2026-07-20 - #278
Merged
qmonnet merged 7 commits intoJul 20, 2026
Merged
Conversation
bpftool_prog_sign() ignores the return value of EVP_Digest(). If the
digest computation fails (context allocation failure, or a digest
fetch failure under OpenSSL), EVP_Digest() returns 0 and leaves the
output buffer untouched, but the function still reports success.
Fixes: 40863f4d6ef2 ("bpftool: Add support for signing BPF programs")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Quentin Monnet <qmo@kernel.org>
Link: https://lore.kernel.org/bpf/20260708075343.358712-5-daniel@iogearbox.net
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
bpftool_prog_sign() signed only the loader instructions. The metadata blob the loader installs was left to an in-loader hash check, which the kernel now performs at load time over insns || metadata. Sign that same concatenation: pass the metadata blob (gen_loader_opts data) through to bpftool_prog_sign() and feed insns || metadata to CMS_final(). The excl_prog_hash stays a digest of the instructions alone; it binds the metadata map to the loader and is matched against prog->digest by the verifier, independent of what the signature covers. The signed artifact is now plain data: both bytes the signature covers are embedded verbatim in the generated skeleton, so signing and verifying an lskel is an ordinary CMS operation that a signer or auditor can perform (or reproduce) offline, without analyzing loader bytecode to establish what the signature actually attests to. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Quentin Monnet <qmo@kernel.org> Link: https://lore.kernel.org/bpf/20260708075343.358712-6-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Pull latest libbpf from mirror. Libbpf version: 1.8.0 Libbpf commit: 2bbc4834e960804351c9b6301ec28cd082484a85 Signed-off-by: Quentin Monnet <qmo@kernel.org>
The btf_vlen(), btf_kind() and btf_kflag() inline helpers defined in tools/lib/bpf/btf.h are thin wrappers around the BTF_INFO_VLEN(), BTF_INFO_KIND() and BTF_INFO_KFLAG() UAPI macros - each one simply returns the corresponding macro applied to t->info. bpftool already uses these helpers in most places, but 13 call sites in btf.c and btf_dumper.c still open-code the raw macros. Use the helpers consistently, matching the rest of bpftool as well as libbpf. No functional change. Signed-off-by: Liang Luo <luoliang@kylinos.cn> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Reviewed-by: Quentin Monnet <qmo@kernel.org> Link: https://lore.kernel.org/bpf/20260702012311.2265001-1-luoliang@kylinos.cn
Update .mailmap based on bpftool's list of contributors and on the latest .mailmap version in the upstream repository. Signed-off-by: Quentin Monnet <qmo@kernel.org>
Syncing latest bpftool commits from kernel repository. Baseline bpf-next commit: 0b58988cacfc91604c4b5be2c3295f8aac0ee3d0 Checkpoint bpf-next commit: 9a3a07d06e7d74f4aecc51396c771149336ac55d Baseline bpf commit: 9b51a6155d14389876916726430da30eabb1d4ed Checkpoint bpf commit: 7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f Daniel Borkmann (2): bpftool: Check EVP_Digest when computing excl_prog_hash bpftool: Cover loader metadata with the program signature luoliang (1): bpftool: Use btf_vlen()/btf_kind()/btf_kflag() helpers consistently src/btf.c | 13 ++++++------- src/btf_dumper.c | 14 +++++++------- src/gen.c | 2 ++ src/sign.c | 24 ++++++++++++++++++++---- 4 files changed, 35 insertions(+), 18 deletions(-) Signed-off-by: Quentin Monnet <qmo@kernel.org>
A recent patch has touched some portions of bpftool's Makefile that differ between kernel's and mirror's sources. Let's update the diff with the expected differences accordingly, to smoothen future sync ups. Signed-off-by: Quentin Monnet <qmo@kernel.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull latest libbpf from mirror and sync bpftool repo with kernel, up to the commits used for libbpf sync. This is an automatic update performed by calling the sync script from this repo: