Re: [PATCH bpf-next 1/4] bpf, arm64: Fix memory leak in bpf_jit_free

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Memory leak of `jit_data->ctx.offset` in `bpf_jit_free()` for the LoongArch architecture.
--

--- Patch [1]: [PATCH bpf-next 1/4] bpf, arm64: Fix memory leak in bpf_jit_free ---
commit 34ee740bc2723be0c26671951b05fa73e1bfc918
Author: Pu Lehui <pulehui@huawei.com>

bpf, arm64: Fix memory leak in bpf_jit_free

This commit fixes a memory leak in the ARM64 BPF JIT compiler. When
bpf_jit_free() cleans up a subprogram after a later subprogram fails JIT
compilation, it now correctly frees the jit_data->ctx.offset array.

> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> index 4cdc7dfb05ba9..f4e4d4578e38a 100644
> --- a/arch/arm64/net/bpf_jit_comp.c
> +++ b/arch/arm64/net/bpf_jit_comp.c
> @@ -3237,6 +3237,7 @@ void bpf_jit_free(struct bpf_prog *prog)
>  		 */
>  		if (jit_data) {
>  			bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
> +			kvfree(jit_data->ctx.offset);

[Severity: High]
This isn't a bug introduced by this patch, but does the same memory leak
exist in the LoongArch BPF JIT compiler?

Looking at arch/loongarch/net/bpf_jit.c in bpf_jit_free():

		if (jit_data) {
			bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
			kfree(jit_data);
		}

It appears jit_data->ctx.offset is not freed there before kfree(jit_data)
is called.

Could this lead to a similar resource leak if userspace loads a BPF program
with multiple subprograms that passes verification but fails JIT compilation?

>  			kfree(jit_data);
>  		}
>  		prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset();

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722112754.1615201-1-pulehui@huaweicloud.com?part=1