[PATCH bpf-next] bpf: Free the subprog jump tables once the CFG passes are done

[PATCH bpf-next] bpf: Free the subprog jump tables once the CFG passes are done

[Daniel Borkmann]

The jump tables which compute_subprog_jts() builds are only read through
bpf_insn_successors() once CFG discovery is done. Its last caller is
bpf_compute_scev(), which runs after bpf_compute_live_registers(), so
free the tables right after it instead of keeping them until the verifier
environment is torn down. With large insn_array maps, this also drops them
before do_check() starts to allocate states.

Dead code removal runs after do_check(), so a removed subprogram no longer
owns a table and adjust_subprog_starts_after_remove() can go back to not
caring about the table pointers.

Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
 [ This was feedback to follow-up from a while back, forgot about it. ]

 kernel/bpf/fixups.c   | 9 +--------
 kernel/bpf/verifier.c | 2 ++
 2 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c
index b2fa7e8bedf3..608621d7f225 100644
--- a/kernel/bpf/fixups.c
+++ b/kernel/bpf/fixups.c
@@ -477,11 +477,7 @@ static int adjust_subprog_starts_after_remove(struct bpf_verifier_env *env,
 
 	if (j > i) {
 		struct bpf_prog_aux *aux = env->prog->aux;
-		int move, k;
-
-		/* The removed subprogs own their jump tables. */
-		for (k = i; k < j; k++)
-			kvfree(env->subprog_info[k].jt);
+		int move;
 
 		/* move fake 'exit' subprog as well */
 		move = env->subprog_cnt + 1 - j;
@@ -489,9 +485,6 @@ static int adjust_subprog_starts_after_remove(struct bpf_verifier_env *env,
 		memmove(env->subprog_info + i,
 			env->subprog_info + j,
 			sizeof(*env->subprog_info) * move);
-		/* The vacated tail still holds copies of the moved entries. */
-		memset(env->subprog_info + i + move, 0,
-		       sizeof(*env->subprog_info) * (j - i));
 		env->subprog_cnt -= j - i;
 
 		/* remove func_info and its aux */
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index ec136cf377c1..62f8951126ba 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -23487,6 +23487,8 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr,
 	if (ret < 0)
 		goto skip_full_check;
 
+	bpf_free_subprog_jts(env);
+
 	ret = mark_fastcall_patterns(env);
 	if (ret < 0)
 		goto skip_full_check;
-- 
2.43.0

Re: [PATCH bpf-next] bpf: Free the subprog jump tables once the CFG passes are done

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Fri, 16 Oct 2026 17:55:59 +0200 you wrote:
> The jump tables which compute_subprog_jts() builds are only read through
> bpf_insn_successors() once CFG discovery is done. Its last caller is
> bpf_compute_scev(), which runs after bpf_compute_live_registers(), so
> free the tables right after it instead of keeping them until the verifier
> environment is torn down. With large insn_array maps, this also drops them
> before do_check() starts to allocate states.
> 
> [...]

Here is the summary with links:
  - [bpf-next] bpf: Free the subprog jump tables once the CFG passes are done
    https://git.kernel.org/bpf/bpf-next/c/d2141481a764

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html