libbpf: fix SIGSEGV when BTF loading fails, but .BTF.ext exists

In case when BTF loading fails despite sanitization, but BPF object has
.BTF.ext loaded as well, we free and null obj->btf, but not
obj->btf_ext. This leads to an attempt to relocate .BTF.ext later on
during bpf_object__load(), which assumes obj->btf is present. This leads
to SIGSEGV on null pointer access. Fix bug by freeing and nulling
obj->btf_ext as well.

Signed-off-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 794dd5064ae8a01d9628c3baade0605a24fa4f44..87168f21ef43fdf3c0ebcca7e6250d6a44cc6f11 100644 (file)
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -1500,6 +1500,12 @@ static int bpf_object__sanitize_and_load_btf(struct bpf_object *obj)
                           BTF_ELF_SEC, err);
                btf__free(obj->btf);
                obj->btf = NULL;
+               /* btf_ext can't exist without btf, so free it as well */
+               if (obj->btf_ext) {
+                       btf_ext__free(obj->btf_ext);
+                       obj->btf_ext = NULL;
+               }
+
                if (bpf_object__is_btf_mandatory(obj))
                        return err;
        }