Re: [PATCH bpf-next v1 1/8] resolve_btfids: Implement generic ensure_mem() to grow arrays

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Strict aliasing violation via `void **` casting leading to potential Use-After-Free.
--

--- Patch [1]: [PATCH bpf-next v1 1/8] resolve_btfids: Implement generic ensure_mem() to grow arrays ---
commit b5970d9bf6b1262c4ad812706df67f4a14ee5411
Author: Ihor Solodrai <ihor.solodrai@linux.dev>

resolve_btfids: Implement generic ensure_mem() to grow arrays

This commit factors out array growth logic from push_*() helpers into a
generic ensure_mem() macro and function. It uses a void ** cast to update
the array pointer upon reallocation.

> diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c
> index f8a91fa7584f4..183466ddc5f97 100644
> --- a/tools/bpf/resolve_btfids/main.c
> +++ b/tools/bpf/resolve_btfids/main.c
> @@ -201,6 +201,35 @@ static int eprintf(int level, int var, const char *fmt, ...)
>  #define pr_info(fmt, ...) \
>  	eprintf(0, verbose, pr_fmt(fmt), ##__VA_ARGS__)
>  
> +/*
> + * Grow *data so it can hold at least cnt elements of elem_sz bytes each.
> + * *cap is the capacity in elements and is updated on growth.
> + */
> +static int __ensure_mem(void **data, u32 *cap, u32 cnt, size_t elem_sz)
> +{
> +	u32 new_cap, old_cap = *cap;
> +	void *arr;
> +
> +	if (cnt <= old_cap)
> +		return 0;
> +
> +	new_cap = max(old_cap + 256, old_cap * 2);
> +	if (new_cap < cnt)
> +		new_cap = cnt;
> +
> +	arr = realloc(*data, elem_sz * new_cap);
> +	if (!arr)
> +		return -ENOMEM;
> +
> +	*data = arr;

[Severity: Medium]
Will this assignment violate strict aliasing rules? Because void * and u32 *
are incompatible types, modifying the pointer through a void ** pointer
violates C strict aliasing.

While core kernel code is compiled with -fno-strict-aliasing, programs under
tools/ are compiled with standard optimizations including -fstrict-aliasing.
If __ensure_mem() is inlined, could the compiler assume that this assignment
does not modify the original typed pointer?

> +	*cap = new_cap;
> +
> +	return 0;
> +}
> +
> +#define ensure_mem(arr_ptr, cap_ptr, cnt) \
> +	__ensure_mem((void **)(arr_ptr), (cap_ptr), (cnt), sizeof(**(arr_ptr)))

[Severity: Medium]
Does casting a typed double pointer (like &ctx->decl_tags which is u32 **) to
void ** here set up the strict aliasing violation mentioned above?

[ ... ]

> @@ -890,17 +919,8 @@ static const struct btf_type *btf_type_skip_qualifiers(const struct btf *btf, s3
>  
>  static int push_decl_tag_id(struct btf2btf_context *ctx, u32 decl_tag_id)
>  {
> -	u32 *arr = ctx->decl_tags;
> -	u32 cap = ctx->max_decl_tags;
> -
> -	if (ctx->nr_decl_tags + 1 > cap) {
> -		cap = max(cap + 256, cap * 2);
> -		arr = realloc(arr, sizeof(u32) * cap);
> -		if (!arr)
> -			return -ENOMEM;
> -		ctx->max_decl_tags = cap;
> -		ctx->decl_tags = arr;
> -	}
> +	if (ensure_mem(&ctx->decl_tags, &ctx->max_decl_tags, ctx->nr_decl_tags + 1))
> +		return -ENOMEM;
>  
>  	ctx->decl_tags[ctx->nr_decl_tags++] = decl_tag_id;

[Severity: Medium]
Could this assignment result in a use-after-free? If the compiler's strict
aliasing optimization assumes ctx->decl_tags was not modified by ensure_mem(),
it might use a cached pointer that was freed by realloc() during the array
assignment.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722233518.778854-1-ihor.solodrai@linux.dev?part=1