Commit 380044c4 authored by Jiri Olsa's avatar Jiri Olsa Committed by Alexei Starovoitov
Browse files

libbpf: Prevent double close and leak of btf objects 

Sashiko found possible double close of btf object fd [1],
which happens when strdup in load_module_btfs fails at which
point the obj->btf_module_cnt is already incremented.

The error path close btf fd and so does later cleanup code in
bpf_object_post_load_cleanup function.

Also libbpf_ensure_mem failure leaves btf object not assigned
and it's leaked.

Replacing the err_out label with break to make the error path
less confusing as suggested by Alan.

Incrementing obj->btf_module_cnt only if there's no failure
and releasing btf object in error path.

Fixes: 91abb4a6 ("libbpf: Support attachment of BPF tracing programs to kernel modules")
[1] https://sashiko.dev/#/patchset/20260324081846.2334094-1-jolsa%40kernel.org


Signed-off-by: default avatarJiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20260416100034.1610852-1-jolsa@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent d6f5841a

tools/lib/bpf/libbpf.c

+11 −10
Original line number Diff line number Diff line
@@ -5852,11 +5852,12 @@ static int load_module_btfs(struct bpf_object *obj) 
		info.name = ptr_to_u64(name);

		info.name_len = sizeof(name);



		btf = NULL;

		err = bpf_btf_get_info_by_fd(fd, &info, &len);

		if (err) {

			err = -errno;

			pr_warn("failed to get BTF object #%d info: %s\n", id, errstr(err));

			goto err_out;

			break;

		}



		/* ignore non-module BTFs */
@@ -5870,15 +5871,15 @@ static int load_module_btfs(struct bpf_object *obj) 
		if (err) {

			pr_warn("failed to load module [%s]'s BTF object #%d: %s\n",

				name, id, errstr(err));

			goto err_out;

			break;

		}



		err = libbpf_ensure_mem((void **)&obj->btf_modules, &obj->btf_module_cap,

					sizeof(*obj->btf_modules), obj->btf_module_cnt + 1);

		if (err)

			goto err_out;

			break;



		mod_btf = &obj->btf_modules[obj->btf_module_cnt++];

		mod_btf = &obj->btf_modules[obj->btf_module_cnt];



		mod_btf->btf = btf;

		mod_btf->id = id;
@@ -5886,16 +5887,16 @@ static int load_module_btfs(struct bpf_object *obj) 
		mod_btf->name = strdup(name);

		if (!mod_btf->name) {

			err = -ENOMEM;

			goto err_out;

			break;

		}

		obj->btf_module_cnt++;

	}

		continue;



err_out:

	if (err) {

		btf__free(btf);

		close(fd);

		return err;

	}



	return 0;

	return err;

}



static struct bpf_core_cand_list *