Re: [PATCH bpf-next v3 3/9] parisc: Fix memory leak in bpf_jit_free

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Pre-existing memory leak of the allocated JIT image (`jit_data->header`) in `bpf_int_jit_compile()` if `build_body()` fails during an iteration after the image is allocated.
--

--- Patch [3]: [PATCH bpf-next v3 3/9] parisc: Fix memory leak in bpf_jit_free ---
commit 91fdce2769b7bfc645bd4e9356cd152dd1568159
Author: Pu Lehui <pulehui@huawei.com>

parisc: Fix memory leak in bpf_jit_free

If a subprogram fails to JIT in jit_subprogs(), previously JITed
subprograms are freed. However, the generic bpf_jit_free() fails to
free their leftover jit_data, causing a memory leak.

> diff --git a/arch/parisc/net/bpf_jit_core.c b/arch/parisc/net/bpf_jit_core.c
> index 172770132440d..ef63c38bdf151 100644
> --- a/arch/parisc/net/bpf_jit_core.c
> +++ b/arch/parisc/net/bpf_jit_core.c
> @@ -178,6 +178,25 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
>  	goto out_offset;
>  }

[Severity: High]
This is a pre-existing issue, but does bpf_int_jit_compile() leak
jit_data->header on some error paths?

Looking at bpf_int_jit_compile(), if build_body() fails during an iteration
after the image is allocated:

	for (i = 0; i < NR_JIT_ITERATIONS; i++) {
		...
		if (build_body(ctx, extra_pass, ctx->offset))
			goto out_err;
		...
		if (ctx->ninsns == prev_ninsns) {
			if (jit_data->header)
				break;
			...
			jit_data->header = bpf_jit_binary_alloc(...);

The code jumps to out_err, which falls through to out_offset (seen above):

out_err:
	if (extra_pass) {
		...
	}
	goto out_offset;

However, the out_offset cleanup block only frees ctx->offset and jit_data,
and skips freeing the already allocated jit_data->header:

out_offset:
		kfree(ctx->offset);
		kfree(jit_data);
		prog->aux->jit_data = NULL;

Could this lead to a memory leak of the JIT image buffer?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725154915.2488611-1-pulehui@huaweicloud.com?part=3