Re: [PATCH v2 bpf-next 09/18] bpftool: Handle multi-split BTF by supporting multiple base BTFs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Memory leak of intermediate base BTF objects in the multi-split chain on the success path, and leak of the entire chain on the error path.
--

commit af485a13fcb0c9c0f013599abed8bb48b059b6e0
Author: Alan Maguire <alan.maguire@oracle.com>

bpftool: Handle multi-split BTF by supporting multiple base BTFs

This commit updates bpftool to support multi-split BTF by allowing multiple
base BTFs to be specified via multiple -B arguments.

> diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c
> index 5ababd8f7d0a0..9329f140b700f 100644
> --- a/tools/bpf/bpftool/main.c
> +++ b/tools/bpf/bpftool/main.c
> @@ -515,7 +515,8 @@ int main(int argc, char **argv)
>  			verifier_logs = true;
>  			break;
>  		case 'B':
> -			base_btf = btf__parse(optarg, NULL);
> +			/* handle multi-split BTF */
> +			base_btf = btf__parse_split(optarg, base_btf);

[Severity: Medium]
Does this code leak the previous base_btf objects on error?

If a user supplies multiple -B arguments and parsing fails on a subsequent
-B, the base_btf pointer is overwritten with NULL, losing the reference to
the prior chain.

Does this setup also leak the intermediate bases on the success path?

The chain is built properly, but at exit btf__free(base_btf) only frees the
top-level BTF because objects loaded via btf__parse_split() do not take
ownership (owns_base == false) of their parent base BTF.

>  			if (!base_btf) {
>  				p_err("failed to parse base BTF at '%s': %d\n",
>  				      optarg, -errno);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901165757.801449-1-alan.maguire@oracle.com?part=9