Re: [PATCH bpf-next v3 7/9] bpf, arm64: Fix private stack leak when JIT failed

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Memory leak of the BPF private stack in the PowerPC JIT compiler upon JIT failure.
--

--- Patch [7]: [PATCH bpf-next v3 7/9] bpf, arm64: Fix private stack leak when JIT failed ---
commit 8de8b0f7fc232dba7540d3099301a4c55f3544c0
Author: Pu Lehui <pulehui@huawei.com>

bpf, arm64: Fix private stack leak when JIT failed

This patch fixes a memory leak in the ARM64 BPF JIT compiler. When JIT
compilation fails, the private stack percpu memory was being leaked because
the cleanup check evaluated to false after a pointer was left dangling. The
fix sets the pointer to NULL to ensure proper cleanup.

> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> index f4e4d4578e38a..6e036acf80d8b 100644
> --- a/arch/arm64/net/bpf_jit_comp.c
> +++ b/arch/arm64/net/bpf_jit_comp.c
> @@ -2311,6 +2311,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
>  		bpf_arch_text_copy(&ro_header->size, &header->size,
>  				   sizeof(header->size));
>  		bpf_jit_binary_pack_free(ro_header, header);
> +		ro_header = NULL;

[Severity: Medium]
This is a pre-existing issue, but while fixing this memory leak for arm64,
it appears that the PowerPC JIT compiler has the exact same problem.

In arch/powerpc/net/bpf_jit_comp.c:bpf_int_jit_compile():

		if (bpf_jit_build_body(fp, code_base, fcode_base, &cgctx, addrs, pass,
				       extra_pass)) {
			bpf_arch_text_copy(&fhdr->size, &hdr->size, sizeof(hdr->size));
			bpf_jit_binary_pack_free(fhdr, hdr);
			goto out_err;
		}

When jumping to the error cleanup path, the JIT binary is freed but the image
pointer remains non-NULL.

Then in the cleanup path:

out_addrs:
		if (!image && priv_stack_ptr) {
			fp->aux->priv_stack_ptr = NULL;
			free_percpu(priv_stack_ptr);
		}

Because the image pointer is still non-NULL, this check evaluates to false.
Can this also cause the private stack percpu memory to be leaked in the
PowerPC JIT? Should a similar fix be applied there?

>  	}
>  	goto out_off;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725154915.2488611-1-pulehui@huaweicloud.com?part=7