* [PATCH bpf 1/1] bpf: Fix insn_aux_data leak on verifier err_free_env path
@ 2026-06-24 12:35 KaFai Wan
2026-06-24 14:40 ` Anton Protopopov
0 siblings, 1 reply; 2+ messages in thread
From: KaFai Wan @ 2026-06-24 12:35 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, John Fastabend,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi,
Martin KaFai Lau, Song Liu, Yonghong Song, Jiri Olsa,
Emil Tsalapatis, Anton Protopopov, bpf, linux-kernel
Cc: KaFai Wan
When bpf_check() allocates env->insn_aux_data successfully but later
fails to allocate env->succ, it jumps directly to err_free_env.
The existing vfree(env->insn_aux_data) sits before the err_free_env
label, so that direct jump bypasses it and leaks insn_aux_data.
Move vfree(env->insn_aux_data) into err_free_env so all early and late
exit paths release it consistently.
Fixes: 2f69c5685427 ("bpf: make bpf_insn_successors to return a pointer")
Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
---
kernel/bpf/verifier.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 21a365d436a5..3ccea8985946 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -19994,13 +19994,13 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr,
if (!is_priv)
mutex_unlock(&bpf_verifier_lock);
bpf_clear_insn_aux_data(env, 0, env->prog->len);
- vfree(env->insn_aux_data);
err_free_env:
bpf_stack_liveness_free(env);
kvfree(env->cfg.insn_postorder);
kvfree(env->scc_info);
kvfree(env->succ);
kvfree(env->gotox_tmp_buf);
+ vfree(env->insn_aux_data);
kvfree(env);
return ret;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH bpf 1/1] bpf: Fix insn_aux_data leak on verifier err_free_env path
2026-06-24 12:35 [PATCH bpf 1/1] bpf: Fix insn_aux_data leak on verifier err_free_env path KaFai Wan
@ 2026-06-24 14:40 ` Anton Protopopov
0 siblings, 0 replies; 2+ messages in thread
From: Anton Protopopov @ 2026-06-24 14:40 UTC (permalink / raw)
To: KaFai Wan
Cc: Alexei Starovoitov, Daniel Borkmann, John Fastabend,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi,
Martin KaFai Lau, Song Liu, Yonghong Song, Jiri Olsa,
Emil Tsalapatis, bpf, linux-kernel
On 26/06/24 08:35PM, KaFai Wan wrote:
> When bpf_check() allocates env->insn_aux_data successfully but later
> fails to allocate env->succ, it jumps directly to err_free_env.
>
> The existing vfree(env->insn_aux_data) sits before the err_free_env
> label, so that direct jump bypasses it and leaks insn_aux_data.
>
> Move vfree(env->insn_aux_data) into err_free_env so all early and late
> exit paths release it consistently.
>
> Fixes: 2f69c5685427 ("bpf: make bpf_insn_successors to return a pointer")
> Signed-off-by: KaFai Wan <kafai.wan@linux.dev>
> ---
> kernel/bpf/verifier.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 21a365d436a5..3ccea8985946 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -19994,13 +19994,13 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr,
> if (!is_priv)
> mutex_unlock(&bpf_verifier_lock);
> bpf_clear_insn_aux_data(env, 0, env->prog->len);
> - vfree(env->insn_aux_data);
> err_free_env:
> bpf_stack_liveness_free(env);
> kvfree(env->cfg.insn_postorder);
> kvfree(env->scc_info);
> kvfree(env->succ);
> kvfree(env->gotox_tmp_buf);
> + vfree(env->insn_aux_data);
Thanks!
Reviewed-by: Anton Protopopov <a.s.protopopov@gmail.com>
> kvfree(env);
> return ret;
> }
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-24 14:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-24 12:35 [PATCH bpf 1/1] bpf: Fix insn_aux_data leak on verifier err_free_env path KaFai Wan
2026-06-24 14:40 ` Anton Protopopov
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.