Re: [PATCH bpf-next v1 2/4] libbpf: Render decl_tags in btf_dump

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] libbpf: btf_dump_cmp_decl_tags violates strict weak ordering in qsort
- [Medium] libbpf: duplicate tags and memory leak on btf_dump_resize error paths
--

commit 869ac84b9144d9ee48198dbc0d57c9510a6f9d98
Author: Ihor Solodrai <ihor.solodrai@linux.dev>
Subject: libbpf: Render decl_tags in btf_dump

This commit adds support for rendering BTF_KIND_DECL_TAG in btf_dump.
It builds an array of decl tags sorted by target ID and tag ID, which
are then emitted at every declaration.

> diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
> --- a/tools/lib/bpf/btf_dump.c
> +++ b/tools/lib/bpf/btf_dump.c
> @@ -202,9 +202,15 @@ struct btf_dump *btf_dump__new(const struct btf *btf,
> +static int btf_dump_cmp_decl_tags(const void *a, const void *b)
> +{
> +	const struct decl_tag_desc *x = a, *y = b;
> +
> +	if (x->target_id != y->target_id)
> +		return x->target_id < y->target_id ? -1 : 1;
> +	return x->tag_id < y->tag_id ? -1 : 1;

[Severity: Medium]
Does this comparator satisfy the strict weak ordering requirement for qsort?

If two elements have the same tag_id, this returns 1 instead of 0. Depending
on the libc implementation, returning 1 when comparing an element to itself
or to a duplicate could break antisymmetry and potentially lead to out of
bounds accesses or infinite loops.

> +}

[ ... ]

> @@ -258,8 +258,18 @@ static int btf_dump_resize(struct btf_dump *d)
>  		err = btf_dump_mark_referenced(d, t);
>  		if (err)
>  			return err;

[Severity: Medium]
Do we need to roll back d->decl_tags_cnt or free resources here?

If this loop encounters an error and returns early, it leaves the previously
pushed decl_tags in the array, but d->last_id isn't updated.

If a user handles the error and resumes using the btf_dump object, won't it
re-push those same tags on the next call, causing duplicates and memory leaks?

> +
> +		if (btf_is_decl_tag(t)) {
> +			err = btf_dump_push_decl_tag(d, i, t);
> +			if (err)
> +				return err;

[Severity: Medium]
Similarly, does returning early here lead to the same duplicate tag entries
on retry, since d->decl_tags_cnt is not rolled back on error?

> +		}
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917012037.1396254-1-ihor.solodrai@linux.dev?part=2