[PATCH bpf-next] libbpf: Return -EINVAL from btf__align_of() for unknown type ID

[Abhinav Madake <abhinavmadake@gmail.com>]

btf__align_of() passes the result of btf__type_by_id() straight to
btf_kind() without checking for NULL, so an unknown type ID
dereferences a NULL pointer instead of returning an error like the
other btf__*() lookups do.

BTF parsed from raw data cannot trigger this, since btf_sanity_check()
rejects dangling references. BTF built with the btf__add_*() API can:
those only check the ID range, so a forward reference to a type that
was never added, followed by btf__align_of() on it (directly, or
through the recursive struct/array/typedef cases), crashes.

Check for NULL and return -EINVAL, matching btf__type_by_id().

Link: https://github.com/libbpf/libbpf/issues/983
Signed-off-by: Abhinav Madake <abhinavmadake@gmail.com>
---
 tools/lib/bpf/btf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 908bd3442..d15bc09ac 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -986,8 +986,12 @@ done:
 int btf__align_of(const struct btf *btf, __u32 id)
 {
 	const struct btf_type *t = btf__type_by_id(btf, id);
-	__u16 kind = btf_kind(t);
+	__u16 kind;
 
+	if (!t)
+		return libbpf_err(-EINVAL);
+
+	kind = btf_kind(t);
 	switch (kind) {
 	case BTF_KIND_INT:
 	case BTF_KIND_ENUM:
-- 
2.47.0