Re: [PATCH v3 bpf-next 10/11] selftests/bpf: Test bpftool dump of BTF location info

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: uninitialized stack variable path passed to unlink() on error path
--

commit 7571df89a1b4928d95fd5e997d48f8637c83a473
Author: Alan Maguire <alan.maguire@oracle.com>

selftests/bpf: Test bpftool dump of BTF location info

Add a bpftool raw BTF dump test covering LOC_PARAM, LOC_PROTO, and
LOCSEC types.

> diff --git a/tools/testing/selftests/bpf/prog_tests/bpftool_btf_dump.c b/tools/testing/selftests/bpf/prog_tests/bpftool_btf_dump.c
> --- a/tools/testing/selftests/bpf/prog_tests/bpftool_btf_dump.c
> +++ b/tools/testing/selftests/bpf/prog_tests/bpftool_btf_dump.c
> @@ -175,4 +249,14 @@ void test_bpftool_btf_dump(void)
>  	unlink(path);
>  out_btf:
>  	btf__free(btf);
> +
> +	btf = mk_loc_btf();
> +	if (!btf)
> +		return;
> +
> +	if (!btf_to_tmpfile(btf, path) && test__start_subtest("loc_dump"))
> +		test_loc_dump(path);
> +
> +	unlink(path);

[Severity: Medium]
Is there a risk of passing uninitialized stack memory to unlink() here?

If btf_to_tmpfile() fails early, for example if btf__raw_data() returns NULL:

tools/testing/selftests/bpf/prog_tests/bpftool_btf_dump.c:btf_to_tmpfile() {
        ...
        raw = btf__raw_data(btf, &sz);
        if (!ASSERT_OK_PTR(raw, "raw_data"))
                return -1;
        ...
}

The path buffer remains uninitialized stack memory. The short-circuit
evaluation in test_bpftool_btf_dump() will skip test_loc_dump(), but it
looks like the execution will then proceed directly to this unconditional
unlink(path) call.

> +	btf__free(btf);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916074118.1007116-1-alan.maguire@oracle.com?part=10