diff options
| author |   Andrii Nakryiko <andriin@fb.com> | 2019-07-19 12:32:42 -0700 |
|---|---|---|
| committer |   Alexei Starovoitov <ast@kernel.org> | 2019-07-19 12:37:18 -0700 |
| commit | 04efe5911fb30664a56ec63d272a0f39a71545db (patch) | |
| tree | cc7cd8cf784c8f3e620c793aa7068a8fe43b2414 /tools | |
| parent | tcp: fix tcp_set_congestion_control() use from bpf hook (diff) | |
| download | linux-dev-04efe5911fb30664a56ec63d272a0f39a71545db.tar.xz linux-dev-04efe5911fb30664a56ec63d272a0f39a71545db.zip | |
libbpf: fix SIGSEGV when BTF loading fails, but .BTF.ext exists
In case when BTF loading fails despite sanitization, but BPF object has
.BTF.ext loaded as well, we free and null obj->btf, but not
obj->btf_ext. This leads to an attempt to relocate .BTF.ext later on
during bpf_object__load(), which assumes obj->btf is present. This leads
to SIGSEGV on null pointer access. Fix bug by freeing and nulling
obj->btf_ext as well.
Signed-off-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'tools')
| -rw-r--r-- | tools/lib/bpf/libbpf.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c index 794dd5064ae8..87168f21ef43 100644 --- a/tools/lib/bpf/libbpf.c +++ b/tools/lib/bpf/libbpf.c @@ -1500,6 +1500,12 @@ static int bpf_object__sanitize_and_load_btf(struct bpf_object *obj) BTF_ELF_SEC, err); btf__free(obj->btf); obj->btf = NULL; + /* btf_ext can't exist without btf, so free it as well */ + if (obj->btf_ext) { + btf_ext__free(obj->btf_ext); + obj->btf_ext = NULL; + } + if (bpf_object__is_btf_mandatory(obj)) return err; } |