Re: [PATCH bpf-next v2 1/7] bpf, arm64: Fix memory leak in bpf_jit_free

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

Pre-existing issues:
- [High] If `bpf_jit_binary_pack_finalize()` fails during `bpf_jit_free()`, it leads to a Use-After-Free and Double-Free of `ro_header`.
- [Medium] Pre-existing memory leaks of intermediate JIT state (`jit_data`, `ctx.offset`, etc.) in other architectures when JIT compilation of subprograms aborts.
- [Medium] The per-CPU private stack (`priv_stack_ptr`) is permanently leaked when JIT compilation fails after allocating `ro_header` on ARM64.
--

--- Patch [1]: [PATCH bpf-next v2 1/7] bpf, arm64: Fix memory leak in bpf_jit_free ---
commit da1c3e7675f67e35f9b079e317bc882f8ea47e77
Author: Pu Lehui <pulehui@huawei.com>

bpf, arm64: Fix memory leak in bpf_jit_free

When bpf_int_jit_compile() is called for subprograms, it returns early
during the first pass (!prog->is_func || extra_pass is false), keeping
ctx->offset alive for the subsequent extra pass.

If JIT compilation fails for a later subprogram, the BPF core aborts and
calls bpf_jit_free() to clean up the first subprogram. However,
bpf_jit_free() fails to free jit_data->ctx.offset, which causes a memory
leak of the JIT context offsets array.

Fix this by adding the missing kvfree(jit_data->ctx.offset) in
bpf_jit_free().

> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> index 4cdc7dfb05ba9..f4e4d4578e38a 100644
> --- a/arch/arm64/net/bpf_jit_comp.c
> +++ b/arch/arm64/net/bpf_jit_comp.c
> @@ -3237,6 +3237,7 @@ void bpf_jit_free(struct bpf_prog *prog)
>  		 */
>  		if (jit_data) {
>  			bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);

[Severity: High]
This isn't a bug introduced by this patch, but does ignoring the return
value of bpf_jit_binary_pack_finalize() here cause a use-after-free?

If bpf_jit_binary_pack_finalize() fails internally, it frees ro_header.
However, because the return value is ignored, execution continues to:

    hdr = bpf_jit_binary_pack_hdr(prog);
    bpf_jit_binary_pack_free(hdr, NULL);

This would retrieve the already-freed ro_header and call
bpf_jit_binary_pack_free() on it again, leading to a double-free. Is
it necessary to check the return value of bpf_jit_binary_pack_finalize()
here?

> +			kvfree(jit_data->ctx.offset);

[Severity: Medium]
This is a pre-existing issue, but does this same intermediate JIT state
leak in other architectures when JIT compilation of subprograms aborts?

For example, architectures like S390 and SPARC64 allocate jit_data in
bpf_int_jit_compile() but appear to lack a bpf_jit_free() override to
clean it up, falling back to the weak generic implementation which only
frees the binary header.

Additionally, LoongArch's bpf_jit_free() frees jit_data but seems to miss
the same kvfree(jit_data->ctx.offset) that this patch adds for ARM64.

Could these other architectures be updated to prevent permanent memory
leaks of jit_data and ctx.offset on error paths?

[Severity: Medium]
This is also a pre-existing issue, but does the error handling in
bpf_int_jit_compile() permanently leak the private stack?

If bpf_int_jit_compile() fails after allocating ro_header, it jumps to
out_free_hdr:

arch/arm64/net/bpf_jit_comp.c:bpf_int_jit_compile() {
    ...
out_free_hdr:
    if (header) {
        bpf_arch_text_copy(&ro_header->size, &header->size,
                           sizeof(header->size));
        bpf_jit_binary_pack_free(ro_header, header);
    }
    goto out_off;

out_off:
    if (!ro_header && priv_stack_ptr) {
        free_percpu(priv_stack_ptr);
        prog->aux->priv_stack_ptr = NULL;
    }
    ...
}

Because ro_header is freed but never set to NULL before jumping to out_off,
the (!ro_header && priv_stack_ptr) condition evaluates to false, skipping
the free_percpu() call. Since prog->jited is set to 0, bpf_jit_free() also
bypasses its cleanup block, permanently leaking priv_stack_ptr.

Should ro_header be set to NULL in out_free_hdr to ensure the private stack
is properly freed?

>  			kfree(jit_data);
>  		}
>  		prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset();

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725102020.2287770-1-pulehui@huaweicloud.com?part=1