[PATCH bpf-next] libbpf: fix memory leak when emitting final btf_ext

Subsystems: bpf [general] (safe dynamic programs and tools), bpf [library] (libbpf), the rest

STALE1960d LANDED

Landed in mainline as 05d817031ff9 on 2021-03-30.

3 messages, 3 authors, 2021-03-30 · open the first message on its own page

[PATCH bpf-next] libbpf: fix memory leak when emitting final btf_ext

From: Andrii Nakryiko <andrii@kernel.org>
Date: 2021-03-27 04:33:41

Free temporary allocated memory used to construct finalized .BTF.ext data.
Found by Coverity static analysis on libbpf's Github repo.

Fixes: 8fd27bf69b86 ("libbpf: Add BPF static linker BTF and BTF.ext support")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
 tools/lib/bpf/linker.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
index a29d62ff8041..46b16cbdcda3 100644
--- a/tools/lib/bpf/linker.c
+++ b/tools/lib/bpf/linker.c

@@ -1906,8 +1906,10 @@ static int finalize_btf_ext(struct bpf_linker *linker)
 			struct dst_sec *sec = &linker->secs[i];
 
 			sz = emit_btf_ext_data(linker, cur, sec->sec_name, &sec->func_info);
-			if (sz < 0)
-				return sz;
+			if (sz < 0) {
+				err = sz;
+				goto out;
+			}
 
 			cur += sz;
 		}

@@ -1921,8 +1923,10 @@ static int finalize_btf_ext(struct bpf_linker *linker)
 			struct dst_sec *sec = &linker->secs[i];
 
 			sz = emit_btf_ext_data(linker, cur, sec->sec_name, &sec->line_info);
-			if (sz < 0)
-				return sz;
+			if (sz < 0) {
+				err = sz;
+				goto out;
+			}
 
 			cur += sz;
 		}

@@ -1936,8 +1940,10 @@ static int finalize_btf_ext(struct bpf_linker *linker)
 			struct dst_sec *sec = &linker->secs[i];
 
 			sz = emit_btf_ext_data(linker, cur, sec->sec_name, &sec->core_relo_info);
-			if (sz < 0)
-				return sz;
+			if (sz < 0) {
+				err = sz;
+				goto out;
+			}
 
 			cur += sz;
 		}

@@ -1948,8 +1954,10 @@ static int finalize_btf_ext(struct bpf_linker *linker)
 	if (err) {
 		linker->btf_ext = NULL;
 		pr_warn("failed to parse final .BTF.ext data: %d\n", err);
-		return err;
+		goto out;
 	}
 
-	return 0;
+out:
+	free(data);
+	return err;
 }

-- 
2.30.2

Re: [PATCH bpf-next] libbpf: fix memory leak when emitting final btf_ext

From: Song Liu <song@kernel.org>
Date: 2021-03-29 15:56:06

On Fri, Mar 26, 2021 at 9:35 PM Andrii Nakryiko [off-list ref] wrote:

Free temporary allocated memory used to construct finalized .BTF.ext data.
Found by Coverity static analysis on libbpf's Github repo.

Fixes: 8fd27bf69b86 ("libbpf: Add BPF static linker BTF and BTF.ext support")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Acked-by: Song Liu <redacted>

quoted hunk

---
 tools/lib/bpf/linker.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
index a29d62ff8041..46b16cbdcda3 100644
--- a/tools/lib/bpf/linker.c
+++ b/tools/lib/bpf/linker.c

@@ -1906,8 +1906,10 @@ static int finalize_btf_ext(struct bpf_linker *linker)
                        struct dst_sec *sec = &linker->secs[i];

                        sz = emit_btf_ext_data(linker, cur, sec->sec_name, &sec->func_info);
-                       if (sz < 0)
-                               return sz;
+                       if (sz < 0) {
+                               err = sz;
+                               goto out;
+                       }

                        cur += sz;
                }

@@ -1921,8 +1923,10 @@ static int finalize_btf_ext(struct bpf_linker *linker)
                        struct dst_sec *sec = &linker->secs[i];

                        sz = emit_btf_ext_data(linker, cur, sec->sec_name, &sec->line_info);
-                       if (sz < 0)
-                               return sz;
+                       if (sz < 0) {
+                               err = sz;
+                               goto out;
+                       }

                        cur += sz;
                }

@@ -1936,8 +1940,10 @@ static int finalize_btf_ext(struct bpf_linker *linker)
                        struct dst_sec *sec = &linker->secs[i];

                        sz = emit_btf_ext_data(linker, cur, sec->sec_name, &sec->core_relo_info);
-                       if (sz < 0)
-                               return sz;
+                       if (sz < 0) {
+                               err = sz;
+                               goto out;
+                       }

                        cur += sz;
                }

@@ -1948,8 +1954,10 @@ static int finalize_btf_ext(struct bpf_linker *linker)
        if (err) {
                linker->btf_ext = NULL;
                pr_warn("failed to parse final .BTF.ext data: %d\n", err);
-               return err;
+               goto out;
        }

-       return 0;
+out:
+       free(data);
+       return err;
 }
--

2.30.2

Re: [PATCH bpf-next] libbpf: fix memory leak when emitting final btf_ext

From: Alexei Starovoitov <hidden>
Date: 2021-03-30 16:33:44

On 3/26/21 9:25 PM, Andrii Nakryiko wrote:

Free temporary allocated memory used to construct finalized .BTF.ext data.
Found by Coverity static analysis on libbpf's Github repo.

Fixes: 8fd27bf69b86 ("libbpf: Add BPF static linker BTF and BTF.ext support")
Signed-off-by: Andrii Nakryiko<andrii@kernel.org>

Applied.

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help