tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

libbpf: Prevent double close and leak of btf objects

Sashiko found possible double close of btf object fd [1],
which happens when strdup in load_module_btfs fails at which
point the obj->btf_module_cnt is already incremented.

The error path close btf fd and so does later cleanup code in
bpf_object_post_load_cleanup function.

Also libbpf_ensure_mem failure leaves btf object not assigned
and it's leaked.

Replacing the err_out label with break to make the error path
less confusing as suggested by Alan.

Incrementing obj->btf_module_cnt only if there's no failure
and releasing btf object in error path.

Fixes: 91abb4a6d79d ("libbpf: Support attachment of BPF tracing programs to kernel modules")
[1] https://sashiko.dev/#/patchset/20260324081846.2334094-1-jolsa%40kernel.org
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20260416100034.1610852-1-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

authored by

Jiri Olsa and committed by
Alexei Starovoitov 380044c4 d6f5841a

+12 -11
+12 -11
tools/lib/bpf/libbpf.c
··· 5852 5852 info.name = ptr_to_u64(name); 5853 5853 info.name_len = sizeof(name); 5854 5854 5855 + btf = NULL; 5855 5856 err = bpf_btf_get_info_by_fd(fd, &info, &len); 5856 5857 if (err) { 5857 5858 err = -errno; 5858 5859 pr_warn("failed to get BTF object #%d info: %s\n", id, errstr(err)); 5859 - goto err_out; 5860 + break; 5860 5861 } 5861 5862 5862 5863 /* ignore non-module BTFs */ ··· 5871 5870 if (err) { 5872 5871 pr_warn("failed to load module [%s]'s BTF object #%d: %s\n", 5873 5872 name, id, errstr(err)); 5874 - goto err_out; 5873 + break; 5875 5874 } 5876 5875 5877 5876 err = libbpf_ensure_mem((void **)&obj->btf_modules, &obj->btf_module_cap, 5878 5877 sizeof(*obj->btf_modules), obj->btf_module_cnt + 1); 5879 5878 if (err) 5880 - goto err_out; 5879 + break; 5881 5880 5882 - mod_btf = &obj->btf_modules[obj->btf_module_cnt++]; 5881 + mod_btf = &obj->btf_modules[obj->btf_module_cnt]; 5883 5882 5884 5883 mod_btf->btf = btf; 5885 5884 mod_btf->id = id; ··· 5887 5886 mod_btf->name = strdup(name); 5888 5887 if (!mod_btf->name) { 5889 5888 err = -ENOMEM; 5890 - goto err_out; 5889 + break; 5891 5890 } 5892 - continue; 5893 - 5894 - err_out: 5895 - close(fd); 5896 - return err; 5891 + obj->btf_module_cnt++; 5897 5892 } 5898 5893 5899 - return 0; 5894 + if (err) { 5895 + btf__free(btf); 5896 + close(fd); 5897 + } 5898 + return err; 5900 5899 } 5901 5900 5902 5901 static struct bpf_core_cand_list *