Re: [PATCH v6 bpf-next 02/10] libbpf: Support kind layout section handling in BTF

bot+bpf-ci
2025-12-10T20:56:00Z

[-- Attachment #1: Type: text/plain, Size: 1793 bytes --]

> diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
> index b136572e889a..737adc560818 100644
> --- a/tools/lib/bpf/btf.c
> +++ b/tools/lib/bpf/btf.c

[ ... ]

> @@ -994,6 +1048,7 @@ void btf__free(struct btf *btf)
>
> static struct btf *btf_new_empty(struct btf *base_btf)
> {
> + struct btf_header *hdr;
> struct btf *btf;
>
> btf = calloc(1, sizeof(*btf));
> @@ -1022,14 +1077,20 @@ static struct btf *btf_new_empty(struct btf *base_btf)
> return ERR_PTR(-ENOMEM);
> }
>
> - btf->hdr = btf->raw_data;
> - btf->hdr->hdr_len = sizeof(struct btf_header);
> - btf->hdr->magic = BTF_MAGIC;
> - btf->hdr->version = BTF_VERSION;
> + hdr = btf->raw_data;
> + hdr->hdr_len = sizeof(struct btf_header);
> + hdr->magic = BTF_MAGIC;
> + hdr->version = BTF_VERSION;
>
> - btf->types_data = btf->raw_data + btf->hdr->hdr_len;
> - btf->strs_data = btf->raw_data + btf->hdr->hdr_len;
> - btf->hdr->str_len = base_btf ? 0 : 1; /* empty string at offset 0 */
> + btf->types_data = btf->raw_data + hdr->hdr_len;
> + btf->strs_data = btf->raw_data + hdr->hdr_len;
> + hdr->str_len = base_btf ? 0 : 1; /* empty string at offset 0 */
> + btf->hdr = calloc(1, sizeof(struct btf_header));
> + if (!btf->hdr) {
> + free(btf);
> + return ERR_PTR(-ENOMEM);
> + }
> + memcpy(btf->hdr, hdr, sizeof(*hdr));
>
> return btf;
> }

Does this leak btf->raw_data when the btf->hdr allocation fails? The
btf->raw_data was allocated earlier (at line 1074 in the new code), but
if we reach the error path here, we only free(btf) without freeing
btf->raw_data first.

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/20112692486