[PATCH bpf] selftests/bpf: Add BTF repeated field count overflow t=
From: Paul Moses
Date: Tue Jun 09 2026 - 06:08:54 EST
Add a raw BTF test that exercises repeated special-field expansion with a
large array count. The compact element layout keeps the array byte size
representable while the repeated field count overflows the old u32 capacity
calculation in btf_repeat_fields().
Signed-off-by: Paul Moses <p@xxxxxxx>
---
tools/testing/selftests/bpf/prog_tests/btf.c | 37 ++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/s=
elftests/bpf/prog_tests/btf.c
index 054ecb6b1e9f..9fcbc554e351 100644
--- a/tools/testing/selftests/bpf/prog_tests/btf.c
+++ b/tools/testing/selftests/bpf/prog_tests/btf.c
@@ -4258,6 +4258,43 @@ static struct btf_raw_test raw_tests[] =3D {
=09.max_entries =3D 1,
},
+{
+=09.descr =3D "struct test repeated fields count overflow",
+=09.raw_types =3D {
+=09=09BTF_TYPE_INT_ENC(NAME_TBD, BTF_INT_SIGNED, 0, 32, 4),=09/* [1] */
+=09=09BTF_STRUCT_ENC(NAME_TBD, 0, 0),=09=09=09=09/* [2] */
+=09=09BTF_TYPE_TAG_ENC(NAME_TBD, 2),=09=09=09=09/* [3] */
+=09=09BTF_PTR_ENC(3),=09=09=09=09=09=09/* [4] */
+=09=09BTF_TYPE_ARRAY_ENC(4, 1, 1),=09=09=09=09/* [5] */
+=09=09BTF_STRUCT_ENC(NAME_TBD, 10, 8),=09=09=09/* [6] */
+=09=09BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+=09=09BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+=09=09BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+=09=09BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+=09=09BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+=09=09BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+=09=09BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+=09=09BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+=09=09BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+=09=09BTF_MEMBER_ENC(NAME_TBD, 5, 0),
+=09=09BTF_TYPE_ARRAY_ENC(6, 1, 0x1999999aU),=09=09=09/* [7] */
+=09=09BTF_STRUCT_ENC(NAME_TBD, 2, 8 + 8 * 0x1999999aU),=09/* [8] */
+=09=09BTF_MEMBER_ENC(NAME_TBD, 4, 0),
+=09=09BTF_MEMBER_ENC(NAME_TBD, 7, 64),
+=09=09BTF_END_RAW,
+=09},
+=09BTF_STR_SEC("\0int\0prog_test_ref_kfunc\0kptr_untrusted\0elem"
+=09=09 "\0p0\0p1\0p2\0p3\0p4\0p5\0p6\0p7\0p8\0p9"
+=09=09 "\0outer\0trigger\0elems"),
+=09.map_type =3D BPF_MAP_TYPE_ARRAY,
+=09.map_name =3D "repeat_fields",
+=09.key_size =3D sizeof(int),
+=09.value_size =3D 8 + 8 * 0x1999999aU,
+=09.key_type_id =3D 1,
+=09.value_type_id =3D 8,
+=09.max_entries =3D 1,
+=09.btf_load_err =3D true,
+},
}; /* struct btf_raw_test raw_tests[] */
static const char *get_next_str(const char *start, const char *end)
--
2.54.0