Re: [PATCH bpf 1/2] libbpf: Fix btf object leak in load_module_btfs

[Jiri Olsa <olsajiri@gmail.com>]

On Tue, Apr 14, 2026 at 08:28:59PM +0000, bot+bpf-ci@kernel.org wrote:
> > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> > --- a/tools/lib/bpf/libbpf.c
> > +++ b/tools/lib/bpf/libbpf.c
> 
> [ ... ]
> 
> > @@ -5771,6 +5770,8 @@ static int load_module_btfs(struct bpf_object *obj)
> >  		return 0;
> >
> >  	while (true) {
> > +		struct btf *btf = NULL;
> > +
> >  		err = bpf_btf_get_next_id(id, &id);
> 
> [ ... ]
> 
> > @@ -5837,6 +5838,7 @@
> >  		continue;
> >
> >  err_out:
> > +		btf__free(btf);
> >  		close(fd);
> >  		return err;
> >  	}
> 
> When strdup(name) fails a few lines above this, btf_module_cnt has
> already been incremented and mod_btf->btf already holds the btf
> pointer:
> 
>     mod_btf = &obj->btf_modules[obj->btf_module_cnt++];
>     mod_btf->btf = btf;
>     ...
>     mod_btf->name = strdup(name);
>     if (!mod_btf->name) {
>         err = -ENOMEM;
>         goto err_out;
>     }
> 
> Can this double-free btf?  The new btf__free(btf) here frees the
> object, but bpf_object_post_load_cleanup() will iterate btf_module_cnt
> entries and call btf__free(obj->btf_modules[i].btf) on the same
> pointer.  Similarly, close(fd) here and close(obj->btf_modules[i].fd)
> in cleanup would double-close the fd.
> 
> This is addressed by the next patch in the series (36358f0b8f1b
> "libbpf: Prevent double close of btf objects") which defers the
> btf_module_cnt increment until after strdup succeeds.

ok, I'll squash both changes in v2

jirka

> 
> 
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
> 
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24420241619