backport patches from upstream

backport-libbpf-Deal-with-section-with-no-data-gracefully.patch

@@ -0,0 +1,44 @@
+From 3ee4823fcb6d3b090942650464dfe52c3f8f99b3 Mon Sep 17 00:00:00 2001
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Date: Wed, 12 Oct 2022 10:23:52 +0800
+Subject: [PATCH] libbpf: Deal with section with no data gracefully
+
+ELF section data pointer returned by libelf may be NULL (if section has
+SHT_NOBITS), so null check section data pointer before attempting to
+copy license and kversion section.
+
+Fixes: cb1e5e961991 ("bpf tools: Collect version and license from ELF sections")
+Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20221012022353.7350-3-shung-hsi.yu@suse.com
+---
+ src/libbpf.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/libbpf.c b/src/libbpf.c
+index 2e8ac13..29e9df0 100644
+--- a/src/libbpf.c
++++ b/src/libbpf.c
+@@ -1408,6 +1408,10 @@ static int bpf_object__check_endianness(struct bpf_object *obj)
+ static int
+ bpf_object__init_license(struct bpf_object *obj, void *data, size_t size)
+ {
++	if (!data) {
++		pr_warn("invalid license section in %s\n", obj->path);
++		return -LIBBPF_ERRNO__FORMAT;
++	}
+ 	/* libbpf_strlcpy() only copies first N - 1 bytes, so size + 1 won't
+ 	 * go over allowed ELF data section buffer
+ 	 */
+@@ -1421,7 +1425,7 @@ bpf_object__init_kversion(struct bpf_object *obj, void *data, size_t size)
+ {
+ 	__u32 kver;
+ 
+-	if (size != sizeof(kver)) {
++	if (!data || size != sizeof(kver)) {
+ 		pr_warn("invalid kver section in %s\n", obj->path);
+ 		return -LIBBPF_ERRNO__FORMAT;
+ 	}
+-- 
+2.33.0
+

backport-libbpf-Fix-crash-if-SEC-freplace-programs-don-t-have.patch

@@ -0,0 +1,59 @@
+From 0ff6d28aecf2980407ccbb7b79727f3349f74510 Mon Sep 17 00:00:00 2001
+From: Andrii Nakryiko <andrii@kernel.org>
+Date: Fri, 9 Sep 2022 12:30:52 -0700
+Subject: [PATCH] libbpf: Fix crash if SEC("freplace") programs don't have
+ attach_prog_fd set
+
+Fix SIGSEGV caused by libbpf trying to find attach type in vmlinux BTF
+for freplace programs. It's wrong to search in vmlinux BTF and libbpf
+doesn't even mark vmlinux BTF as required for freplace programs. So
+trying to search anything in obj->vmlinux_btf might cause NULL
+dereference if nothing else in BPF object requires vmlinux BTF.
+
+Instead, error out if freplace (EXT) program doesn't specify
+attach_prog_fd during at the load time.
+
+Fixes: 91abb4a6d79d ("libbpf: Support attachment of BPF tracing programs to kernel modules")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20220909193053.577111-3-andrii@kernel.org
+---
+ src/libbpf.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/src/libbpf.c b/src/libbpf.c
+index 3ad1392..2ca30cc 100644
+--- a/src/libbpf.c
++++ b/src/libbpf.c
+@@ -9084,11 +9084,15 @@ static int libbpf_find_attach_btf_id(struct bpf_program *prog, const char *attac
+ 	int err = 0;
+ 
+ 	/* BPF program's BTF ID */
+-	if (attach_prog_fd) {
++	if (prog->type == BPF_PROG_TYPE_EXT || attach_prog_fd) {
++		if (!attach_prog_fd) {
++			pr_warn("prog '%s': attach program FD is not set\n", prog->name);
++			return -EINVAL;
++		}
+ 		err = libbpf_find_prog_btf_id(attach_name, attach_prog_fd);
+ 		if (err < 0) {
+-			pr_warn("failed to find BPF program (FD %d) BTF ID for '%s': %d\n",
+-				 attach_prog_fd, attach_name, err);
++			pr_warn("prog '%s': failed to find BPF program (FD %d) BTF ID for '%s': %d\n",
++				 prog->name, attach_prog_fd, attach_name, err);
+ 			return err;
+ 		}
+ 		*btf_obj_fd = 0;
+@@ -9105,7 +9109,8 @@ static int libbpf_find_attach_btf_id(struct bpf_program *prog, const char *attac
+ 		err = find_kernel_btf_id(prog->obj, attach_name, attach_type, btf_obj_fd, btf_type_id);
+ 	}
+ 	if (err) {
+-		pr_warn("failed to find kernel BTF type ID of '%s': %d\n", attach_name, err);
++		pr_warn("prog '%s': failed to find kernel BTF type ID of '%s': %d\n",
++			prog->name, attach_name, err);
+ 		return err;
+ 	}
+ 	return 0;
+-- 
+2.33.0
+

backport-libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch

@@ -0,0 +1,39 @@
+From 3a3ef0c1d09e1894740db71cdcb7be0bfd713671 Mon Sep 17 00:00:00 2001
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Date: Wed, 12 Oct 2022 10:23:53 +0800
+Subject: [PATCH] libbpf: Fix null-pointer dereference in
+ find_prog_by_sec_insn()
+
+When there are no program sections, obj->programs is left unallocated,
+and find_prog_by_sec_insn()'s search lands on &obj->programs[0] == NULL,
+and will cause null-pointer dereference in the following access to
+prog->sec_idx.
+
+Guard the search with obj->nr_programs similar to what's being done in
+__bpf_program__iter() to prevent null-pointer access from happening.
+
+Fixes: db2b8b06423c ("libbpf: Support CO-RE relocations for multi-prog sections")
+Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20221012022353.7350-4-shung-hsi.yu@suse.com
+---
+ src/libbpf.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/libbpf.c b/src/libbpf.c
+index 29e9df0..8c3f236 100644
+--- a/src/libbpf.c
++++ b/src/libbpf.c
+@@ -4115,6 +4115,9 @@ static struct bpf_program *find_prog_by_sec_insn(const struct bpf_object *obj,
+ 	int l = 0, r = obj->nr_programs - 1, m;
+ 	struct bpf_program *prog;
+ 
++	if (!obj->nr_programs)
++		return NULL;
++
+ 	while (l < r) {
+ 		m = l + (r - l + 1) / 2;
+ 		prog = &obj->programs[m];
+-- 
+2.33.0
+

backport-libbpf-Fix-overrun-in-netlink-attribute-iteration.patch

@@ -0,0 +1,33 @@
+From 3745a20b2802cb215de0b3d4e289777209c73e16 Mon Sep 17 00:00:00 2001
+From: Xin Liu <liuxin350@huawei.com>
+Date: Fri, 30 Sep 2022 17:07:08 +0800
+Subject: [PATCH] libbpf: Fix overrun in netlink attribute iteration
+
+I accidentally found that a change in commit 1045b03e07d8 ("netlink: fix
+overrun in attribute iteration") was not synchronized to the function
+`nla_ok` in tools/lib/bpf/nlattr.c, I think it is necessary to modify,
+this patch will do it.
+
+Signed-off-by: Xin Liu <liuxin350@huawei.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20220930090708.62394-1-liuxin350@huawei.com
+---
+ src/nlattr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/nlattr.c b/src/nlattr.c
+index f57e77a..3900d05 100644
+--- a/src/nlattr.c
++++ b/src/nlattr.c
+@@ -32,7 +32,7 @@ static struct nlattr *nla_next(const struct nlattr *nla, int *remaining)
+ 
+ static int nla_ok(const struct nlattr *nla, int remaining)
+ {
+-	return remaining >= sizeof(*nla) &&
++	return remaining >= (int)sizeof(*nla) &&
+ 	       nla->nla_len >= sizeof(*nla) &&
+ 	       nla->nla_len <= remaining;
+ }
+-- 
+2.33.0
+

backport-libbpf-Fix-the-case-of-running-as-non-root-with-capa.patch

@@ -0,0 +1,87 @@
+From 9da0dcb62149ab0a6c5711813d77a844ec6f393b Mon Sep 17 00:00:00 2001
+From: Jon Doron <jond@wiz.io>
+Date: Sun, 25 Sep 2022 10:04:31 +0300
+Subject: [PATCH] libbpf: Fix the case of running as non-root with capabilities
+
+When running rootless with special capabilities like:
+FOWNER / DAC_OVERRIDE / DAC_READ_SEARCH
+
+The "access" API will not make the proper check if there is really
+access to a file or not.
+
+>From the access man page:
+"
+The check is done using the calling process's real UID and GID, rather
+than the effective IDs as is done when actually attempting an operation
+(e.g., open(2)) on the file.  Similarly, for the root user, the check
+uses the set of permitted capabilities  rather than the set of effective
+capabilities; ***and for non-root users, the check uses an empty set of
+capabilities.***
+"
+
+What that means is that for non-root user the access API will not do the
+proper validation if the process really has permission to a file or not.
+
+To resolve this this patch replaces all the access API calls with
+faccessat with AT_EACCESS flag.
+
+Signed-off-by: Jon Doron <jond@wiz.io>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20220925070431.1313680-1-arilou@gmail.com
+---
+ src/btf.c    | 2 +-
+ src/libbpf.c | 4 ++--
+ src/usdt.c   | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/btf.c b/src/btf.c
+index 3d6c30d..a542787 100644
+--- a/src/btf.c
++++ b/src/btf.c
+@@ -4694,7 +4694,7 @@ struct btf *btf__load_vmlinux_btf(void)
+ 	for (i = 0; i < ARRAY_SIZE(locations); i++) {
+ 		snprintf(path, PATH_MAX, locations[i].path_fmt, buf.release);
+ 
+-		if (access(path, R_OK))
++		if (faccessat(AT_FDCWD, path, R_OK, AT_EACCESS))
+ 			continue;
+ 
+ 		if (locations[i].raw_btf)
+diff --git a/src/libbpf.c b/src/libbpf.c
+index 632c92d..fcaad31 100644
+--- a/src/libbpf.c
++++ b/src/libbpf.c
+@@ -823,7 +823,7 @@ __u32 get_kernel_version(void)
+ 	__u32 major, minor, patch;
+ 	struct utsname info;
+ 
+-	if (access(ubuntu_kver_file, R_OK) == 0) {
++	if (faccessat(AT_FDCWD, ubuntu_kver_file, R_OK, AT_EACCESS) == 0) {
+ 		FILE *f;
+ 
+ 		f = fopen(ubuntu_kver_file, "r");
+@@ -11261,7 +11261,7 @@ static int resolve_full_path(const char *file, char *result, size_t result_sz)
+ 				continue;
+ 			snprintf(result, result_sz, "%.*s/%s", seg_len, s, file);
+ 			/* ensure it is an executable file/link */
+-			if (access(result, R_OK | X_OK) < 0)
++			if (faccessat(AT_FDCWD, result, R_OK | X_OK, AT_EACCESS) < 0)
+ 				continue;
+ 			pr_debug("resolved '%s' to '%s'\n", file, result);
+ 			return 0;
+diff --git a/src/usdt.c b/src/usdt.c
+index f1c9339..058b91a 100644
+--- a/src/usdt.c
++++ b/src/usdt.c
+@@ -282,7 +282,7 @@ struct usdt_manager *usdt_manager_new(struct bpf_object *obj)
+ 	 * If this is not supported, USDTs with semaphores will not be supported.
+ 	 * Added in: a6ca88b241d5 ("trace_uprobe: support reference counter in fd-based uprobe")
+ 	 */
+-	man->has_sema_refcnt = access(ref_ctr_sysfs_path, F_OK) == 0;
++	man->has_sema_refcnt = faccessat(AT_FDCWD, ref_ctr_sysfs_path, F_OK, AT_EACCESS) == 0;
+ 
+ 	return man;
+ }
+-- 
+2.33.0
+

backport-libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch

@@ -0,0 +1,136 @@
+From 54caf920db0e489de90f3aaaa41e2a51ddbcd084 Mon Sep 17 00:00:00 2001
+From: Xu Kuohai <xukuohai@huawei.com>
+Date: Tue, 11 Oct 2022 08:01:03 -0400
+Subject: [PATCH] libbpf: Fix use-after-free in btf_dump_name_dups
+
+ASAN reports an use-after-free in btf_dump_name_dups:
+
+ERROR: AddressSanitizer: heap-use-after-free on address 0xffff927006db at pc 0xaaaab5dfb618 bp 0xffffdd89b890 sp 0xffffdd89b928
+READ of size 2 at 0xffff927006db thread T0
+    #0 0xaaaab5dfb614 in __interceptor_strcmp.part.0 (test_progs+0x21b614)
+    #1 0xaaaab635f144 in str_equal_fn tools/lib/bpf/btf_dump.c:127
+    #2 0xaaaab635e3e0 in hashmap_find_entry tools/lib/bpf/hashmap.c:143
+    #3 0xaaaab635e72c in hashmap__find tools/lib/bpf/hashmap.c:212
+    #4 0xaaaab6362258 in btf_dump_name_dups tools/lib/bpf/btf_dump.c:1525
+    #5 0xaaaab636240c in btf_dump_resolve_name tools/lib/bpf/btf_dump.c:1552
+    #6 0xaaaab6362598 in btf_dump_type_name tools/lib/bpf/btf_dump.c:1567
+    #7 0xaaaab6360b48 in btf_dump_emit_struct_def tools/lib/bpf/btf_dump.c:912
+    #8 0xaaaab6360630 in btf_dump_emit_type tools/lib/bpf/btf_dump.c:798
+    #9 0xaaaab635f720 in btf_dump__dump_type tools/lib/bpf/btf_dump.c:282
+    #10 0xaaaab608523c in test_btf_dump_incremental tools/testing/selftests/bpf/prog_tests/btf_dump.c:236
+    #11 0xaaaab6097530 in test_btf_dump tools/testing/selftests/bpf/prog_tests/btf_dump.c:875
+    #12 0xaaaab6314ed0 in run_one_test tools/testing/selftests/bpf/test_progs.c:1062
+    #13 0xaaaab631a0a8 in main tools/testing/selftests/bpf/test_progs.c:1697
+    #14 0xffff9676d214 in __libc_start_main ../csu/libc-start.c:308
+    #15 0xaaaab5d65990  (test_progs+0x185990)
+
+0xffff927006db is located 11 bytes inside of 16-byte region [0xffff927006d0,0xffff927006e0)
+freed by thread T0 here:
+    #0 0xaaaab5e2c7c4 in realloc (test_progs+0x24c7c4)
+    #1 0xaaaab634f4a0 in libbpf_reallocarray tools/lib/bpf/libbpf_internal.h:191
+    #2 0xaaaab634f840 in libbpf_add_mem tools/lib/bpf/btf.c:163
+    #3 0xaaaab636643c in strset_add_str_mem tools/lib/bpf/strset.c:106
+    #4 0xaaaab6366560 in strset__add_str tools/lib/bpf/strset.c:157
+    #5 0xaaaab6352d70 in btf__add_str tools/lib/bpf/btf.c:1519
+    #6 0xaaaab6353e10 in btf__add_field tools/lib/bpf/btf.c:2032
+    #7 0xaaaab6084fcc in test_btf_dump_incremental tools/testing/selftests/bpf/prog_tests/btf_dump.c:232
+    #8 0xaaaab6097530 in test_btf_dump tools/testing/selftests/bpf/prog_tests/btf_dump.c:875
+    #9 0xaaaab6314ed0 in run_one_test tools/testing/selftests/bpf/test_progs.c:1062
+    #10 0xaaaab631a0a8 in main tools/testing/selftests/bpf/test_progs.c:1697
+    #11 0xffff9676d214 in __libc_start_main ../csu/libc-start.c:308
+    #12 0xaaaab5d65990  (test_progs+0x185990)
+
+previously allocated by thread T0 here:
+    #0 0xaaaab5e2c7c4 in realloc (test_progs+0x24c7c4)
+    #1 0xaaaab634f4a0 in libbpf_reallocarray tools/lib/bpf/libbpf_internal.h:191
+    #2 0xaaaab634f840 in libbpf_add_mem tools/lib/bpf/btf.c:163
+    #3 0xaaaab636643c in strset_add_str_mem tools/lib/bpf/strset.c:106
+    #4 0xaaaab6366560 in strset__add_str tools/lib/bpf/strset.c:157
+    #5 0xaaaab6352d70 in btf__add_str tools/lib/bpf/btf.c:1519
+    #6 0xaaaab6353ff0 in btf_add_enum_common tools/lib/bpf/btf.c:2070
+    #7 0xaaaab6354080 in btf__add_enum tools/lib/bpf/btf.c:2102
+    #8 0xaaaab6082f50 in test_btf_dump_incremental tools/testing/selftests/bpf/prog_tests/btf_dump.c:162
+    #9 0xaaaab6097530 in test_btf_dump tools/testing/selftests/bpf/prog_tests/btf_dump.c:875
+    #10 0xaaaab6314ed0 in run_one_test tools/testing/selftests/bpf/test_progs.c:1062
+    #11 0xaaaab631a0a8 in main tools/testing/selftests/bpf/test_progs.c:1697
+    #12 0xffff9676d214 in __libc_start_main ../csu/libc-start.c:308
+    #13 0xaaaab5d65990  (test_progs+0x185990)
+
+The reason is that the key stored in hash table name_map is a string
+address, and the string memory is allocated by realloc() function, when
+the memory is resized by realloc() later, the old memory may be freed,
+so the address stored in name_map references to a freed memory, causing
+use-after-free.
+
+Fix it by storing duplicated string address in name_map.
+
+Fixes: 919d2b1dbb07 ("libbpf: Allow modification of BTF and add btf__add_str API")
+Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/bpf/20221011120108.782373-2-xukuohai@huaweicloud.com
+---
+ src/btf_dump.c | 29 ++++++++++++++++++++++++++---
+ 1 file changed, 26 insertions(+), 3 deletions(-)
+
+diff --git a/src/btf_dump.c b/src/btf_dump.c
+index e4da6de..bf0cc0e 100644
+--- a/src/btf_dump.c
++++ b/src/btf_dump.c
+@@ -219,6 +219,17 @@ static int btf_dump_resize(struct btf_dump *d)
+ 	return 0;
+ }
+ 
++static void btf_dump_free_names(struct hashmap *map)
++{
++	size_t bkt;
++	struct hashmap_entry *cur;
++
++	hashmap__for_each_entry(map, cur, bkt)
++		free((void *)cur->key);
++
++	hashmap__free(map);
++}
++
+ void btf_dump__free(struct btf_dump *d)
+ {
+ 	int i;
+@@ -237,8 +248,8 @@ void btf_dump__free(struct btf_dump *d)
+ 	free(d->cached_names);
+ 	free(d->emit_queue);
+ 	free(d->decl_stack);
+-	hashmap__free(d->type_names);
+-	hashmap__free(d->ident_names);
++	btf_dump_free_names(d->type_names);
++	btf_dump_free_names(d->ident_names);
+ 
+ 	free(d);
+ }
+@@ -1524,11 +1535,23 @@ static void btf_dump_emit_type_cast(struct btf_dump *d, __u32 id,
+ static size_t btf_dump_name_dups(struct btf_dump *d, struct hashmap *name_map,
+ 				 const char *orig_name)
+ {
++	char *old_name, *new_name;
+ 	size_t dup_cnt = 0;
++	int err;
++
++	new_name = strdup(orig_name);
++	if (!new_name)
++		return 1;
+ 
+ 	hashmap__find(name_map, orig_name, (void **)&dup_cnt);
+ 	dup_cnt++;
+-	hashmap__set(name_map, orig_name, (void *)dup_cnt, NULL, NULL);
++
++	err = hashmap__set(name_map, new_name, (void *)dup_cnt,
++			   (const void **)&old_name, NULL);
++	if (err)
++		free(new_name);
++
++	free(old_name);
+ 
+ 	return dup_cnt;
+ }
+-- 
+2.33.0
+

backport-libbpf-Handle-size-overflow-for-ringbuf-mmap.patch

@@ -0,0 +1,62 @@
+From f056d1bd5453c0194d528635672ac073c168e6f4 Mon Sep 17 00:00:00 2001
+From: Hou Tao <houtao1@huawei.com>
+Date: Wed, 16 Nov 2022 15:23:49 +0800
+Subject: [PATCH] libbpf: Handle size overflow for ringbuf mmap
+
+The maximum size of ringbuf is 2GB on x86-64 host, so 2 * max_entries
+will overflow u32 when mapping producer page and data pages. Only
+casting max_entries to size_t is not enough, because for 32-bits
+application on 64-bits kernel the size of read-only mmap region
+also could overflow size_t.
+
+So fixing it by casting the size of read-only mmap region into a __u64
+and checking whether or not there will be overflow during mmap.
+
+Fixes: bf99c936f947 ("libbpf: Add BPF ring buffer support")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20221116072351.1168938-3-houtao@huaweicloud.com
+---
+ src/ringbuf.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/src/ringbuf.c b/src/ringbuf.c
+index 8bc117b..c42ba93 100644
+--- a/src/ringbuf.c
++++ b/src/ringbuf.c
+@@ -59,6 +59,7 @@ int ring_buffer__add(struct ring_buffer *rb, int map_fd,
+ 	__u32 len = sizeof(info);
+ 	struct epoll_event *e;
+ 	struct ring *r;
++	__u64 mmap_sz;
+ 	void *tmp;
+ 	int err;
+ 
+@@ -97,8 +98,7 @@ int ring_buffer__add(struct ring_buffer *rb, int map_fd,
+ 	r->mask = info.max_entries - 1;
+ 
+ 	/* Map writable consumer page */
+-	tmp = mmap(NULL, rb->page_size, PROT_READ | PROT_WRITE, MAP_SHARED,
+-		   map_fd, 0);
++	tmp = mmap(NULL, rb->page_size, PROT_READ | PROT_WRITE, MAP_SHARED, map_fd, 0);
+ 	if (tmp == MAP_FAILED) {
+ 		err = -errno;
+ 		pr_warn("ringbuf: failed to mmap consumer page for map fd=%d: %d\n",
+@@ -111,8 +111,12 @@ int ring_buffer__add(struct ring_buffer *rb, int map_fd,
+ 	 * data size to allow simple reading of samples that wrap around the
+ 	 * end of a ring buffer. See kernel implementation for details.
+ 	 * */
+-	tmp = mmap(NULL, rb->page_size + 2 * info.max_entries, PROT_READ,
+-		   MAP_SHARED, map_fd, rb->page_size);
++	mmap_sz = rb->page_size + 2 * (__u64)info.max_entries;
++	if (mmap_sz != (__u64)(size_t)mmap_sz) {
++		pr_warn("ringbuf: ring buffer size (%u) is too big\n", info.max_entries);
++		return libbpf_err(-E2BIG);
++	}
++	tmp = mmap(NULL, (size_t)mmap_sz, PROT_READ, MAP_SHARED, map_fd, rb->page_size);
+ 	if (tmp == MAP_FAILED) {
+ 		err = -errno;
+ 		ringbuf_unmap_ring(rb, r);
+-- 
+2.33.0
+

backport-libbpf-Use-page-size-as-max_entries-when-probing-rin.patch

@@ -0,0 +1,43 @@
+From b822a139e3997a0a09da940e5c88ea505459e81f Mon Sep 17 00:00:00 2001
+From: Hou Tao <houtao1@huawei.com>
+Date: Wed, 16 Nov 2022 15:23:48 +0800
+Subject: [PATCH] libbpf: Use page size as max_entries when probing ring buffer
+ map
+
+Using page size as max_entries when probing ring buffer map, else the
+probe may fail on host with 64KB page size (e.g., an ARM64 host).
+
+After the fix, the output of "bpftool feature" on above host will be
+correct.
+
+Before :
+    eBPF map_type ringbuf is NOT available
+    eBPF map_type user_ringbuf is NOT available
+
+After :
+    eBPF map_type ringbuf is available
+    eBPF map_type user_ringbuf is available
+
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20221116072351.1168938-2-houtao@huaweicloud.com
+---
+ src/libbpf_probes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/libbpf_probes.c b/src/libbpf_probes.c
+index 97b06ce..49c36cb 100644
+--- a/src/libbpf_probes.c
++++ b/src/libbpf_probes.c
+@@ -289,7 +289,7 @@ static int probe_map_create(enum bpf_map_type map_type, __u32 ifindex)
+ 	case BPF_MAP_TYPE_RINGBUF:
+ 		key_size = 0;
+ 		value_size = 0;
+-		max_entries = 4096;
++		max_entries = sysconf(_SC_PAGE_SIZE);
+ 		break;
+ 	case BPF_MAP_TYPE_STRUCT_OPS:
+ 		/* we'll get -ENOTSUPP for invalid BTF type ID for struct_ops */
+-- 
+2.33.0
+

backport-sync-start-syncing-include-uapi-linux-fcntl.h-UAPI-h.patch

@@ -0,0 +1,152 @@
+From 3b6093fd43682ebab7a2d187e4e847068d6ce454 Mon Sep 17 00:00:00 2001
+From: Andrii Nakryiko <andrii@kernel.org>
+Date: Wed, 16 Nov 2022 10:19:07 -0800
+Subject: [PATCH] sync: start syncing include/uapi/linux/fcntl.h UAPI header
+
+Libbpf relies on F_DUPFD_CLOEXEC constant coming from fcntl.h UAPI
+header, so we need to sync it along other UAPI headers. Also update sync
+script to keep doing this automatically going forward.
+
+Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+---
+ include/uapi/linux/fcntl.h | 114 +++++++++++++++++++++++++++++++++++++
+ scripts/sync-kernel.sh     |   1 +
+ 2 files changed, 115 insertions(+)
+ create mode 100644 include/uapi/linux/fcntl.h
+
+diff --git a/include/uapi/linux/fcntl.h b/include/uapi/linux/fcntl.h
+new file mode 100644
+index 0000000..2f86b2a
+--- /dev/null
++++ b/include/uapi/linux/fcntl.h
+@@ -0,0 +1,114 @@
++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++#ifndef _UAPI_LINUX_FCNTL_H
++#define _UAPI_LINUX_FCNTL_H
++
++#include <asm/fcntl.h>
++#include <linux/openat2.h>
++
++#define F_SETLEASE	(F_LINUX_SPECIFIC_BASE + 0)
++#define F_GETLEASE	(F_LINUX_SPECIFIC_BASE + 1)
++
++/*
++ * Cancel a blocking posix lock; internal use only until we expose an
++ * asynchronous lock api to userspace:
++ */
++#define F_CANCELLK	(F_LINUX_SPECIFIC_BASE + 5)
++
++/* Create a file descriptor with FD_CLOEXEC set. */
++#define F_DUPFD_CLOEXEC	(F_LINUX_SPECIFIC_BASE + 6)
++
++/*
++ * Request nofications on a directory.
++ * See below for events that may be notified.
++ */
++#define F_NOTIFY	(F_LINUX_SPECIFIC_BASE+2)
++
++/*
++ * Set and get of pipe page size array
++ */
++#define F_SETPIPE_SZ	(F_LINUX_SPECIFIC_BASE + 7)
++#define F_GETPIPE_SZ	(F_LINUX_SPECIFIC_BASE + 8)
++
++/*
++ * Set/Get seals
++ */
++#define F_ADD_SEALS	(F_LINUX_SPECIFIC_BASE + 9)
++#define F_GET_SEALS	(F_LINUX_SPECIFIC_BASE + 10)
++
++/*
++ * Types of seals
++ */
++#define F_SEAL_SEAL	0x0001	/* prevent further seals from being set */
++#define F_SEAL_SHRINK	0x0002	/* prevent file from shrinking */
++#define F_SEAL_GROW	0x0004	/* prevent file from growing */
++#define F_SEAL_WRITE	0x0008	/* prevent writes */
++#define F_SEAL_FUTURE_WRITE	0x0010  /* prevent future writes while mapped */
++/* (1U << 31) is reserved for signed error codes */
++
++/*
++ * Set/Get write life time hints. {GET,SET}_RW_HINT operate on the
++ * underlying inode, while {GET,SET}_FILE_RW_HINT operate only on
++ * the specific file.
++ */
++#define F_GET_RW_HINT		(F_LINUX_SPECIFIC_BASE + 11)
++#define F_SET_RW_HINT		(F_LINUX_SPECIFIC_BASE + 12)
++#define F_GET_FILE_RW_HINT	(F_LINUX_SPECIFIC_BASE + 13)
++#define F_SET_FILE_RW_HINT	(F_LINUX_SPECIFIC_BASE + 14)
++
++/*
++ * Valid hint values for F_{GET,SET}_RW_HINT. 0 is "not set", or can be
++ * used to clear any hints previously set.
++ */
++#define RWH_WRITE_LIFE_NOT_SET	0
++#define RWH_WRITE_LIFE_NONE	1
++#define RWH_WRITE_LIFE_SHORT	2
++#define RWH_WRITE_LIFE_MEDIUM	3
++#define RWH_WRITE_LIFE_LONG	4
++#define RWH_WRITE_LIFE_EXTREME	5
++
++/*
++ * The originally introduced spelling is remained from the first
++ * versions of the patch set that introduced the feature, see commit
++ * v4.13-rc1~212^2~51.
++ */
++#define RWF_WRITE_LIFE_NOT_SET	RWH_WRITE_LIFE_NOT_SET
++
++/*
++ * Types of directory notifications that may be requested.
++ */
++#define DN_ACCESS	0x00000001	/* File accessed */
++#define DN_MODIFY	0x00000002	/* File modified */
++#define DN_CREATE	0x00000004	/* File created */
++#define DN_DELETE	0x00000008	/* File removed */
++#define DN_RENAME	0x00000010	/* File renamed */
++#define DN_ATTRIB	0x00000020	/* File changed attibutes */
++#define DN_MULTISHOT	0x80000000	/* Don't remove notifier */
++
++/*
++ * The constants AT_REMOVEDIR and AT_EACCESS have the same value.  AT_EACCESS is
++ * meaningful only to faccessat, while AT_REMOVEDIR is meaningful only to
++ * unlinkat.  The two functions do completely different things and therefore,
++ * the flags can be allowed to overlap.  For example, passing AT_REMOVEDIR to
++ * faccessat would be undefined behavior and thus treating it equivalent to
++ * AT_EACCESS is valid undefined behavior.
++ */
++#define AT_FDCWD		-100    /* Special value used to indicate
++                                           openat should use the current
++                                           working directory. */
++#define AT_SYMLINK_NOFOLLOW	0x100   /* Do not follow symbolic links.  */
++#define AT_EACCESS		0x200	/* Test access permitted for
++                                           effective IDs, not real IDs.  */
++#define AT_REMOVEDIR		0x200   /* Remove directory instead of
++                                           unlinking file.  */
++#define AT_SYMLINK_FOLLOW	0x400   /* Follow symbolic links.  */
++#define AT_NO_AUTOMOUNT		0x800	/* Suppress terminal automount traversal */
++#define AT_EMPTY_PATH		0x1000	/* Allow empty relative pathname */
++
++#define AT_STATX_SYNC_TYPE	0x6000	/* Type of synchronisation required from statx() */
++#define AT_STATX_SYNC_AS_STAT	0x0000	/* - Do whatever stat() does */
++#define AT_STATX_FORCE_SYNC	0x2000	/* - Force the attributes to be sync'd with the server */
++#define AT_STATX_DONT_SYNC	0x4000	/* - Don't sync attributes with the server */
++
++#define AT_RECURSIVE		0x8000	/* Apply to the entire subtree */
++
++#endif /* _UAPI_LINUX_FCNTL_H */
+diff --git a/scripts/sync-kernel.sh b/scripts/sync-kernel.sh
+index 3468e71..b33f19f 100755
+--- a/scripts/sync-kernel.sh
++++ b/scripts/sync-kernel.sh
+@@ -42,6 +42,7 @@ PATH_MAP=(									\
+ 	[tools/include/uapi/linux/bpf_common.h]=include/uapi/linux/bpf_common.h	\
+ 	[tools/include/uapi/linux/bpf.h]=include/uapi/linux/bpf.h		\
+ 	[tools/include/uapi/linux/btf.h]=include/uapi/linux/btf.h		\
++	[tools/include/uapi/linux/fcntl.h]=include/uapi/linux/fcntl.h		\
+ 	[tools/include/uapi/linux/if_link.h]=include/uapi/linux/if_link.h	\
+ 	[tools/include/uapi/linux/if_xdp.h]=include/uapi/linux/if_xdp.h		\
+ 	[tools/include/uapi/linux/netlink.h]=include/uapi/linux/netlink.h	\
+-- 
+2.33.0
+

libbpf.spec

@@ -4,7 +4,7 @@
 
 Name:           %{githubname}
 Version:        %{githubver}
-Release:        3
+Release:        4
 Summary:        Libbpf library
 
 License:        LGPLv2 or BSD
@@ -16,6 +16,16 @@ Patch0000:	backport-libbpf-Fix-determine_ptr_size-guessing.patch
 Patch0001:      backport-libbpf-preserve-errno-across-pr_warn-pr_info-pr_debug.patch
 Patch0002:      backport-libbpf-Ensure-functions-with-always_inline-attribute-are-inline.patch
 Patch0003:      backport-libbpf-Fix-the-name-of-a-reused-map.patch
+Patch0004:      backport-libbpf-Fix-crash-if-SEC-freplace-programs-don-t-have.patch
+Patch0005:      backport-libbpf-Fix-the-case-of-running-as-non-root-with-capa.patch
+Patch0006:      backport-libbpf-Fix-overrun-in-netlink-attribute-iteration.patch
+Patch0007:      backport-libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch
+Patch0008:      backport-libbpf-Deal-with-section-with-no-data-gracefully.patch
+Patch0009:      backport-libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch
+Patch0010:      backport-sync-start-syncing-include-uapi-linux-fcntl.h-UAPI-h.patch
+Patch0011:      backport-libbpf-Handle-size-overflow-for-ringbuf-mmap.patch
+Patch0012:      backport-libbpf-Use-page-size-as-max_entries-when-probing-rin.patch
+
 # This package supersedes libbpf from kernel-tools,
 # which has default Epoch: 0. By having Epoch: 1
 # this libbpf will take over smoothly
@@ -67,6 +77,16 @@ developing applications that use %{name}
 %{_libdir}/libbpf.a
 
 %changelog
+* Sat Mar 11 2023 SuperCharge <xiesongyang@huawei.com> -2:0.8.1-4
+- backport patches from upstream:
+  backport-libbpf-Fix-overrun-in-netlink-attribute-iteration.patch
+  backport-libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch
+  backport-libbpf-Deal-with-section-with-no-data-gracefully.patch
+  backport-libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch
+  backport-sync-start-syncing-include-uapi-linux-fcntl.h-UAPI-h.patch
+  backport-libbpf-Handle-size-overflow-for-ringbuf-mmap.patch
+  backport-libbpf-Use-page-size-as-max_entries-when-probing-rin.patch
+
 * Fri Jan 6 2023 zhangmingyi<zhangmingyi5@huawei.com> - 2:0.8.1-3
 -- backporting: backport-libbpf-Ensure-functions-with-always_inline-attribute-are-inline.patch 
 		backport-libbpf-Fix-the-name-of-a-reused-map.patch