[PATCH bpf-next] selftests/bpf: Guard link cleanup in fexit_bpf2bpf

[PATCH bpf-next] selftests/bpf: Guard link cleanup in fexit_bpf2bpf

[Zhixing Chen]

test_fexit_bpf2bpf_common() can jump to the common cleanup path before
the link array is allocated, for example if bpf_prog_get_info_by_fd()
fails. The cleanup loop still indexes link[i] unconditionally, which can
dereference a NULL pointer and hide the original failure.

Guard the loop so the test reports the original failure instead.

Signed-off-by: Zhixing Chen <running910@gmail.com>
---
 tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c b/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c
index 6262c81cdaa9..d2f2dcc0f2e1 100644
--- a/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c
+++ b/tools/testing/selftests/bpf/prog_tests/fexit_bpf2bpf.c
@@ -164,8 +164,10 @@ static void test_fexit_bpf2bpf_common(const char *obj_file,
 		goto close_prog;
 
 close_prog:
-	for (i = 0; i < prog_cnt; i++)
-		bpf_link__destroy(link[i]);
+	if (link) {
+		for (i = 0; i < prog_cnt; i++)
+			bpf_link__destroy(link[i]);
+	}
 	bpf_object__close(obj);
 	bpf_object__close(tgt_obj);
 	free(link);

base-commit: 71b75648d1a21c0a6379741d00f41086ec95f14a
-- 
2.34.1

Re: [PATCH bpf-next] selftests/bpf: Guard link cleanup in fexit_bpf2bpf

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1168 bytes --]

> test_fexit_bpf2bpf_common() can jump to the common cleanup path before
> the link array is allocated, for example if bpf_prog_get_info_by_fd()
> fails. The cleanup loop still indexes link[i] unconditionally, which can
> dereference a NULL pointer and hide the original failure.
>
> Guard the loop so the test reports the original failure instead.
>
> Signed-off-by: Zhixing Chen <running910@gmail.com>

This patch fixes a real NULL pointer dereference in existing test code.
The old cleanup loop unconditionally reads link[0] off a NULL base when
link == NULL, and every one of the 7 callers passes prog_cnt >= 1.

Should this include a Fixes: tag?  The buggy cleanup loop (accessing
link[i] without checking if link is NULL) was introduced in cd241b77f5b7.
This is checked mechanically by CI on the bpf list, so the tag should point
at the commit that actually introduced the bug:

  Fixes: cd241b77f5b7 ("adding ci files")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/35207993886

Re: [PATCH bpf-next] selftests/bpf: Guard link cleanup in fexit_bpf2bpf

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Andrii Nakryiko <andrii@kernel.org>:

On Thu, 17 Sep 2026 17:39:28 +0800 you wrote:
> test_fexit_bpf2bpf_common() can jump to the common cleanup path before
> the link array is allocated, for example if bpf_prog_get_info_by_fd()
> fails. The cleanup loop still indexes link[i] unconditionally, which can
> dereference a NULL pointer and hide the original failure.
> 
> Guard the loop so the test reports the original failure instead.
> 
> [...]

Here is the summary with links:
  - [bpf-next] selftests/bpf: Guard link cleanup in fexit_bpf2bpf
    https://git.kernel.org/bpf/bpf-next/c/80ed1435d97d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html