[bpf] libbpf: fix SIGSEGV when BTF loading fails, but .BTF.ext exists
diff mbox series

Message ID 20190719193242.2658962-1-andriin@fb.com
State Accepted
Delegated to: BPF Maintainers
Headers show
Series
  • [bpf] libbpf: fix SIGSEGV when BTF loading fails, but .BTF.ext exists
Related show

Commit Message

Andrii Nakryiko July 19, 2019, 7:32 p.m. UTC
In case when BTF loading fails despite sanitization, but BPF object has
.BTF.ext loaded as well, we free and null obj->btf, but not
obj->btf_ext. This leads to an attempt to relocate .BTF.ext later on
during bpf_object__load(), which assumes obj->btf is present. This leads
to SIGSEGV on null pointer access. Fix bug by freeing and nulling
obj->btf_ext as well.

Signed-off-by: Andrii Nakryiko <andriin@fb.com>
---
 tools/lib/bpf/libbpf.c | 6 ++++++
 1 file changed, 6 insertions(+)

Comments

Alexei Starovoitov July 19, 2019, 7:38 p.m. UTC | #1
On 7/19/19 12:32 PM, Andrii Nakryiko wrote:
> In case when BTF loading fails despite sanitization, but BPF object has
> .BTF.ext loaded as well, we free and null obj->btf, but not
> obj->btf_ext. This leads to an attempt to relocate .BTF.ext later on
> during bpf_object__load(), which assumes obj->btf is present. This leads
> to SIGSEGV on null pointer access. Fix bug by freeing and nulling
> obj->btf_ext as well.
> 
> Signed-off-by: Andrii Nakryiko <andriin@fb.com>

Applied. Thanks

Patch
diff mbox series

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 794dd5064ae8..87168f21ef43 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -1500,6 +1500,12 @@  static int bpf_object__sanitize_and_load_btf(struct bpf_object *obj)
 			   BTF_ELF_SEC, err);
 		btf__free(obj->btf);
 		obj->btf = NULL;
+		/* btf_ext can't exist without btf, so free it as well */
+		if (obj->btf_ext) {
+			btf_ext__free(obj->btf_ext);
+			obj->btf_ext = NULL;
+		}
+
 		if (bpf_object__is_btf_mandatory(obj))
 			return err;
 	}