btf__align_of() passes the result of btf__type_by_id() to btf_kind() without a NULL check, so an unknown type ID crashes. Parsed BTF cannot hit this since btf_sanity_check() rejects dangling references, but BTF built with btf__add_*() can, as those only check the ID range. Return 0 with errno set to EINVAL, like the unsupported-kind case. Link: https://github.com/libbpf/libbpf/issues/983 Signed-off-by: Abhinav Madake --- v2: return 0 with errno instead of -EINVAL, callers test for 0. tools/lib/bpf/btf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c index 908bd3442..6bfbc7a65 100644 --- a/tools/lib/bpf/btf.c +++ b/tools/lib/bpf/btf.c @@ -986,8 +986,12 @@ done: int btf__align_of(const struct btf *btf, __u32 id) { const struct btf_type *t = btf__type_by_id(btf, id); - __u16 kind = btf_kind(t); + __u16 kind; + if (!t) + return errno = EINVAL, 0; + + kind = btf_kind(t); switch (kind) { case BTF_KIND_INT: case BTF_KIND_ENUM: -- 2.47.0