From acff58e305175df35985082b0e79103a2497f702 Mon Sep 17 00:00:00 2001 From: Luis Vieira Date: Tue, 29 Sep 2026 22:56:12 -0300 Subject: [PATCH] libbpf: Fix cleanup on invalid CO-RE relocation offsets bpf_object__relocate_core() allocates a CO-RE candidate cache before processing relocation records. Two instruction offset validation failures return -EINVAL directly instead of going through the common cleanup path. These checks were moved into bpf_object__relocate_core() when bpf_core_apply_relo() was split, preserving direct returns that were safe in the previous helper but now bypass cleanup. Route both failures through the out path so the candidate cache and target BTF override are released. Signed-off-by: Luis Vieira Signed-off-by: Alexei Starovoitov Link: https://patch.msgid.link/20260929-libbpf-core-relo-cleanup-v1-1-c9cd0b5775a9@gmail.com --- tools/lib/bpf/libbpf.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c index 238e35c1ee3f..fdd69aac39bd 100644 --- a/tools/lib/bpf/libbpf.c +++ b/tools/lib/bpf/libbpf.c @@ -6255,8 +6255,11 @@ bpf_object__relocate_core(struct bpf_object *obj, const char *targ_btf_path) pr_debug("sec '%s': found %u CO-RE relocations\n", sec_name, sec->num_info); for_each_btf_ext_rec(seg, sec, i, rec) { - if (rec->insn_off % BPF_INSN_SZ) - return -EINVAL; + if (rec->insn_off % BPF_INSN_SZ) { + err = -EINVAL; + goto out; + } + insn_idx = rec->insn_off / BPF_INSN_SZ; prog = find_prog_by_sec_insn(obj, sec_idx, insn_idx); if (!prog) { @@ -6283,8 +6286,10 @@ bpf_object__relocate_core(struct bpf_object *obj, const char *targ_btf_path) * relocated, so it's enough to just subtract in-section offset */ insn_idx = insn_idx - prog->sec_insn_off; - if (insn_idx >= prog->insns_cnt) - return -EINVAL; + if (insn_idx >= prog->insns_cnt) { + err = -EINVAL; + goto out; + } insn = &prog->insns[insn_idx]; if (is_ldimm64_insn(insn) && (size_t)insn_idx + 1 >= prog->insns_cnt) {