Re: resolve_btfids segmentation fault with CONFIG_DEBUG_INFO_BTF_INLINE

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Mon Nov 2, 2026 at 5:47 PM UTC, Alan Maguire wrote:
> On 10/31/26 8:36 PM, Alexei Starovoitov wrote:
>> Thanks for the report.
>> 
>> It's a use-after-free in libbpf that resolve_btfids --inline runs into
>> on a module whose BTF has no strings of its own.
>> 
>> With the patch below that module builds and ASAN is quiet. The output of
>> resolve_btfids for vmlinux and for the modules of my other test builds
>> is the same byte for byte with and without the patch.
>> 
>> Please give it a try.
>> 
>> [PATCH bpf] libbpf: Fix use-after-free in btf__add_type()
>> 
>> For every string btf_rewrite_str() does:
>> 
>>   off = btf__add_str(p->dst, btf__str_by_offset(p->src, *str_off));
>> 
>> When the string belongs to the base, the pointer goes into the raw data
>> of the base. btf__add_str() looks the string up in the base first,
>> btf__find_str() calls btf_ensure_modifiable() on the base, and that
>> frees the raw data. Then strset__find_str() reads the freed string.
>> 
>> Make all the bases of dst modifiable before the pointer is taken. 
>> 
>> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
>
>
> Thanks for the report and the proposed fix! I've reproduced the
> failure with Nathan's config + latest LLVM 24, and can confirm
> that the suggested fix works. So feel free to add
>
> Tested-by: Alan Maguire <almagui@kernel.org>
>
> I'll try and come up with a test that exercises the failure path.
> Thanks again!

Could you pls commandeer it and send a patch?