[PATCH bpf-next] libbpf: Fix cleanup on invalid CO-RE relocation offsets

[PATCH bpf-next] libbpf: Fix cleanup on invalid CO-RE relocation offsets

[Luis Vieira]

bpf_object__relocate_core() allocates a CO-RE candidate cache before
processing relocation records. Two instruction offset validation
failures return -EINVAL directly instead of going through the common
cleanup path.

These checks were moved into bpf_object__relocate_core() when
bpf_core_apply_relo() was split, preserving direct returns that were
safe in the previous helper but now bypass cleanup.

Route both failures through the out path so the candidate cache and
target BTF override are released.

Signed-off-by: Luis Vieira <luisflavieira@gmail.com>
---
 tools/lib/bpf/libbpf.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 238e35c1ee3f..fdd69aac39bd 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -6255,8 +6255,11 @@ bpf_object__relocate_core(struct bpf_object *obj, const char *targ_btf_path)
 		pr_debug("sec '%s': found %u CO-RE relocations\n", sec_name, sec->num_info);
 
 		for_each_btf_ext_rec(seg, sec, i, rec) {
-			if (rec->insn_off % BPF_INSN_SZ)
-				return -EINVAL;
+			if (rec->insn_off % BPF_INSN_SZ) {
+				err = -EINVAL;
+				goto out;
+			}
+
 			insn_idx = rec->insn_off / BPF_INSN_SZ;
 			prog = find_prog_by_sec_insn(obj, sec_idx, insn_idx);
 			if (!prog) {
@@ -6283,8 +6286,10 @@ bpf_object__relocate_core(struct bpf_object *obj, const char *targ_btf_path)
 			 * relocated, so it's enough to just subtract in-section offset
 			 */
 			insn_idx = insn_idx - prog->sec_insn_off;
-			if (insn_idx >= prog->insns_cnt)
-				return -EINVAL;
+			if (insn_idx >= prog->insns_cnt) {
+				err = -EINVAL;
+				goto out;
+			}
 			insn = &prog->insns[insn_idx];
 
 			if (is_ldimm64_insn(insn) && (size_t)insn_idx + 1 >= prog->insns_cnt) {

---
base-commit: cc6010e6e5cbe1f743d3011991041f227d976a5e
change-id: 20260929-libbpf-core-relo-cleanup-43c979ca2cfe

Best regards,
--  
Luis Vieira <luisflavieira@gmail.com>

Re: [PATCH bpf-next] libbpf: Fix cleanup on invalid CO-RE relocation offsets

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Tue, 29 Sep 2026 22:56:12 -0300 you wrote:
> bpf_object__relocate_core() allocates a CO-RE candidate cache before
> processing relocation records. Two instruction offset validation
> failures return -EINVAL directly instead of going through the common
> cleanup path.
> 
> These checks were moved into bpf_object__relocate_core() when
> bpf_core_apply_relo() was split, preserving direct returns that were
> safe in the previous helper but now bypass cleanup.
> 
> [...]

Here is the summary with links:
  - [bpf-next] libbpf: Fix cleanup on invalid CO-RE relocation offsets
    https://git.kernel.org/bpf/bpf-next/c/acff58e30517

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html