[PATCH AUTOSEL 6.18-5.15] libbpf: Also reset {insn,data}_cur on realloc failure

[Sasha Levin]

From: Daniel Borkmann <daniel@xxxxxxxxxxxxx>

[ Upstream commit d2f7bd066ed492aeaf82864fbf1f06770f9d9f9d ]

realloc_insn_buf() as well as realloc_data_buf() free and NULL
gen->insn_start / gen->data_start on -ENOMEM but leave gen->insn_cur /
gen->data_cur pointing into the old, freed buffer. Just reset the
cursors to NULL alongside the base pointers so the freed state is
coherent.

Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
Link: https://lore.kernel.org/r/20260529094119.307264-3-daniel@xxxxxxxxxxxxx
Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---

LLM Generated explanations, may be completely bogus:

The background search for the commit hash finished: `git log --grep` did
not turn up **"libbpf: Also reset {insn,data}_cur on realloc failure"**
in this 6.18.44 tree. The matches were unrelated "reset" commits in
other subsystems, which fits — the fix is not applied here yet.

The earlier analysis still holds: this is patch 3/3 of Daniel Borkmann’s
gen_loader series; patches 2 (hash skip) and the endianness guard are
already in this tree, but the root cursor-reset fix is missing. It’s a
small, real userspace memory-safety fix on the OOM path and should be
backported.

**YES**

 tools/lib/bpf/gen_loader.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/lib/bpf/gen_loader.c b/tools/lib/bpf/gen_loader.c
index d41defa1936d3..4e2d25e024af4 100644
--- a/tools/lib/bpf/gen_loader.c
+++ b/tools/lib/bpf/gen_loader.c
@@ -63,6 +63,7 @@ static int realloc_insn_buf(struct bpf_gen *gen, __u32 size)
 		gen->error = -ENOMEM;
 		free(gen->insn_start);
 		gen->insn_start = NULL;
+		gen->insn_cur = NULL;
 		return -ENOMEM;
 	}
 	gen->insn_start = insn_start;
@@ -86,6 +87,7 @@ static int realloc_data_buf(struct bpf_gen *gen, __u32 size)
 		gen->error = -ENOMEM;
 		free(gen->data_start);
 		gen->data_start = NULL;
+		gen->data_cur = NULL;
 		return -ENOMEM;
 	}
 	gen->data_start = data_start;
-- 
2.53.0