Skip to contentSkip to conversation

libbpf: Prevent double close and leak of btf objects

PATCH Applied Jiri Olsa 2 participants 2 messages Apr 16

Subsystems (2)
BPF libbpf
lore
Share & tools
lore

Jiri Olsa

author reviewer
#0 lore raw

PATCH v3 1/1 libbpf: Prevent double close and leak of btf objects

Sashiko found possible double close of btf object fd [1], which happens when strdup in load_module_btfs fails at which point the obj->btf_module_cnt is already incremented.

The error path close btf fd and so does later cleanup code in bpf_object_post_load_cleanup function.

Also libbpf_ensure_mem failure leaves btf object not assigned and it's leaked.

Replacing the err_out label with break to make the error path less confusing as suggested by Alan.

Incrementing obj->btf_module_cnt only if there's no failure and releasing btf object in error path.

Fixes 91abb4a6d79d ("libbpf: Support attachment of BPF tracing programs to kernel modules")

[1] https://sashiko.dev/#/patchset/20260324081846.2334094-1-jolsa%40kernel.org

Signed-off-by Jiri Olsa <[email protected]>

---
v2: https://lore.kernel.org/bpf/[email protected]/

v3 changes:
- replacing the err_out label with break [Alan]
- subject change [Alan]

 tools/lib/bpf/libbpf.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)
tools/lib/bpf/libbpf.c +11 -10
index 8b0c3246097f..3a80a018fc7d 100644
@@ -5852,11 +5852,12 @@ static int load_module_btfs(struct bpf_object *obj)
 		info.name = ptr_to_u64(name);
 		info.name_len = sizeof(name);
 
+		btf = NULL;
 		err = bpf_btf_get_info_by_fd(fd, &info, &len);
 		if (err) {
 			err = -errno;
 			pr_warn("failed to get BTF object #%d info: %s\n", id, errstr(err));
-			goto err_out;
+			break;
 		}
 
 		/* ignore non-module BTFs */

@@ -5870,15 +5871,15 @@ static int load_module_btfs(struct bpf_object *obj)
 		if (err) {
 			pr_warn("failed to load module [%s]'s BTF object #%d: %s\n",
 				name, id, errstr(err));
-			goto err_out;
+			break;
 		}
 
 		err = libbpf_ensure_mem((void **)&obj->btf_modules, &obj->btf_module_cap,
 					sizeof(*obj->btf_modules), obj->btf_module_cnt + 1);
 		if (err)
-			goto err_out;
+			break;
 
-		mod_btf = &obj->btf_modules[obj->btf_module_cnt++];
+		mod_btf = &obj->btf_modules[obj->btf_module_cnt];
 
 		mod_btf->btf = btf;
 		mod_btf->id = id;

@@ -5886,16 +5887,16 @@ static int load_module_btfs(struct bpf_object *obj)
 		mod_btf->name = strdup(name);
 		if (!mod_btf->name) {
 			err = -ENOMEM;
-			goto err_out;
+			break;
 		}
-		continue;
+		obj->btf_module_cnt++;
+	}
 
-err_out:
+	if (err) {
+		btf__free(btf);
 		close(fd);
-		return err;
 	}
-
-	return 0;
+	return err;
 }
 
 static struct bpf_core_cand_list *
Signature · 1 line
2.53.0
CI Applied
#1 lore raw
This patch was applied to bpf/bpf.git (master) by Alexei Starovoitov <[email protected]>:

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <[email protected]>:

Quoted 8 lines · On Thu, 16 Apr 2026 12:00:34 +0200 you wrote:

Sashiko found possible double close of btf object fd [1], which happens when strdup in load_module_btfs fails at which point the obj->btf_module_cnt is already incremented.

The error path close btf fd and so does later cleanup code in bpf_object_post_load_cleanup function.

[...]

Here is the summary with links:
- [PATCHv3,bpf] libbpf: Prevent double close and leak of btf objects

    https://git.kernel.org/bpf/bpf/c/380044c40b16

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html