Re: [PATCH v2] libbpf: initialize btf_ext out-parameter early in btf_parse_elf()

[Jiri Olsa <olsajiri@gmail.com>]

On Sat, Jul 11, 2026 at 10:18:50PM +0530, Naveed Khan wrote:
> btf_parse_elf() only stores to *btf_ext once it reaches the .BTF.ext
> parsing step.  If the function fails before that point (open() aside,
> e.g. elf_begin() failure, missing .BTF section, or a malformed .BTF /
> .BTF.base section), the cleanup path still runs
> 
> 	if (btf_ext)
> 		btf_ext__free(*btf_ext);
> 
> and reads a value that was never written.  A caller that passes an
> uninitialized pointer, e.g.
> 
> 	struct btf_ext *ext;
> 	btf = btf__parse_elf(path, &ext);
> 
> ends up with btf_ext__free() operating on stack garbage, which can
> crash or corrupt the heap.  Current in-tree callers happen to
> NULL-initialize their pointer, but the API contract should not rely
> on that.
> 
> Initialize *btf_ext to NULL on entry so every exit path leaves the
> out-parameter in a defined state.
> 
> Reported-by: sashiko-bot@kernel.org
> Signed-off-by: Naveed Khan <naveed@digiscrypt.com>
> ---
> >From 4dc7d1c8a2a2ec4c00ec038a94a86e26ab6cf75a Mon Sep 17 00:00:00 2001
> From: Naveed Khan <naveed@digiscrypt.com>
> Date: Sat, 11 Jul 2026 16:19:36 +0530
> Subject: [PATCH] libbpf: initialize btf_ext out-parameter early in
>  btf_parse_elf()

hi,
looks like subject/changelog mishap ?

> 
> btf_parse_elf() only stores to *btf_ext once it reaches the .BTF.ext
> parsing step.  If the function fails before that point (open() aside,
> e.g. elf_begin() failure, missing .BTF section, or a malformed .BTF /
> .BTF.base section), the cleanup path still runs
> 
> 	if (btf_ext)
> 		btf_ext__free(*btf_ext);
> 
> and reads a value that was never written.  A caller that passes an
> uninitialized pointer, e.g.
> 
> 	struct btf_ext *ext;
> 	btf = btf__parse_elf(path, &ext);
> 
> ends up with btf_ext__free() operating on stack garbage, which can
> crash or corrupt the heap.  Current in-tree callers happen to
> NULL-initialize their pointer, but the API contract should not rely
> on that.
> 
> Initialize *btf_ext to NULL on entry so every exit path leaves the
> out-parameter in a defined state.
> 
> Reported-by: sashiko-bot@kernel.org
> Signed-off-by: Naveed Khan <naveed@digiscrypt.com>
> ---
>  tools/lib/bpf/btf.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
> index 823bce8951..cabe8286f0 100644
> --- a/tools/lib/bpf/btf.c
> +++ b/tools/lib/bpf/btf.c
> @@ -1453,6 +1453,9 @@ static struct btf *btf_parse_elf(const char *path, struct btf *base_btf,
>  	int err = 0, fd = -1;
>  	Elf *elf = NULL;
>  
> +	if (btf_ext)
> +		*btf_ext = NULL;

there's already this setup in btf_parse and it can be removed now
when we do that in btf_parse_elf

jirka

> +
>  	if (elf_version(EV_CURRENT) == EV_NONE) {
>  		pr_warn("failed to init libelf for %s\n", path);
>  		return ERR_PTR(-LIBBPF_ERRNO__LIBELF);
> -- 
> 2.52.0
>