Re: [PATCH bpf-next v7 1/2] libbpf: support selective kernel module BTF loading via bpf_object_open_opts

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] If `calloc` fails when allocating `btf_module_allowlist`, a NULL pointer dereference occurs during cleanup in `bpf_object__close()`.
--

commit 2653ece25005f3595512126454652c2d89f17f3d
Author: Fuyu Zhao <zhaofuyu@vivo.com>

libbpf: support selective kernel module BTF loading via bpf_object_open_opts

This commit adds a btf_module_allowlist field to bpf_object_open_opts to
limit which kernel module BTFs libbpf is allowed to load. When the option is
unspecified, behavior remains unchanged, while an explicitly empty list
prevents consulting any module BTFs.

> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index c036e8a91ed88..d49e48c5c1417 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
[ ... ]
> @@ -8563,6 +8610,24 @@ static struct bpf_object *bpf_object_open(const char *path, const void *obj_buf,
>  		}
>  	}
>  
> +	obj->btf_module_allowlist_cnt = mod_allow ? mod_allow_cnt : -1;
> +	if (obj->btf_module_allowlist_cnt > 0) {
> +		obj->btf_module_allowlist = calloc(obj->btf_module_allowlist_cnt,
> +						   sizeof(*obj->btf_module_allowlist));
> +		if (!obj->btf_module_allowlist) {
> +			err = -ENOMEM;
> +			goto out;

[Severity: High]
If this calloc fails, obj->btf_module_allowlist_cnt is left > 0 while
obj->btf_module_allowlist remains NULL. The goto out path will then call
bpf_object__close() to clean up the object.

> +		}
> +
> +		for (i = 0; i < obj->btf_module_allowlist_cnt; i++) {
> +			obj->btf_module_allowlist[i] = strdup(mod_allow[i]);
> +			if (!obj->btf_module_allowlist[i]) {
> +				err = -ENOMEM;
> +				goto out;
> +			}
> +		}
> +	}
[ ... ]
> @@ -9684,6 +9750,10 @@ void bpf_object__close(struct bpf_object *obj)
>  		close(obj->jumptable_maps[i].fd);
>  	zfree(&obj->jumptable_maps);
>  
> +	for (j = 0; j < obj->btf_module_allowlist_cnt; j++)
> +		zfree(&obj->btf_module_allowlist[j]);

[Severity: High]
Will this crash if the initial calloc failed in bpf_object_open()?

Because obj->btf_module_allowlist_cnt is > 0 but obj->btf_module_allowlist
is NULL, the loop will attempt to access &obj->btf_module_allowlist[j],
which evaluates to an offset from NULL. When zfree() tries to dereference
this pointer to free it, it will result in a NULL pointer dereference.

Should obj->btf_module_allowlist_cnt be cleared when calloc fails, or
should this loop check if obj->btf_module_allowlist is valid before looping?

> +	zfree(&obj->btf_module_allowlist);
> +
>  	free(obj);
>  }
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907053847.1115-1-zhaofuyu@vivo.com?part=1