[PATCH bpf-next v3 0/9] Fixes for bpf_jit_free

[PATCH bpf-next v3 0/9] Fixes for bpf_jit_free

[Pu Lehui]

From: Pu Lehui <pulehui@huawei.com>

Fixes for bpf_jit_free identified by Sashiko, as previously noted in [0].

Link: https://lore.kernel.org/bpf/28ba19a4-b487-49fd-bbba-04410acdb113@iogearbox.net/ [0]

v3:
- Add fix for private stack leak on arm64. (Sashiko)
- Some minor fixes.

v2: https://lore.kernel.org/bpf/20260725102020.2287770-1-pulehui@huaweicloud.com
- Fix JITs not freeing leftover jit_data when jit_subprogs() aborts. (Sashiko)
- Drop fix for loongarch as it's applied.

v1: https://lore.kernel.org/bpf/20260722112754.1615201-1-pulehui@huaweicloud.com


Pu Lehui (9):
  bpf: Extract the bpf_jit_binary_hdr helper
  s390/bpf: Fix memory leak in bpf_jit_free
  parisc: Fix memory leak in bpf_jit_free
  bpf, sparc64: Fix memory leak in bpf_jit_free
  ARC, bpf: Fix memory leak in bpf_jit_free
  bpf, arm64: Fix memory leak in bpf_jit_free
  bpf, arm64: Fix private stack leak when JIT failed
  riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free
  bpf: Fix double-free RO header in bpf_jit_free

 arch/arc/net/bpf_jit_core.c      | 19 +++++++++++++++++++
 arch/arm64/net/bpf_jit_comp.c    |  6 +++---
 arch/loongarch/net/bpf_jit.c     |  6 ++----
 arch/parisc/net/bpf_jit_core.c   | 19 +++++++++++++++++++
 arch/powerpc/net/bpf_jit_comp.c  |  5 +++--
 arch/riscv/net/bpf_jit_core.c    |  8 +++-----
 arch/s390/net/bpf_jit_comp.c     | 19 +++++++++++++++++++
 arch/sparc/net/bpf_jit_comp_64.c | 19 +++++++++++++++++++
 arch/x86/net/bpf_jit_comp.c      |  7 ++-----
 include/linux/filter.h           |  2 ++
 kernel/bpf/core.c                | 19 ++++++++++---------
 11 files changed, 101 insertions(+), 28 deletions(-)

-- 
2.34.1

[PATCH bpf-next v3 1/9] bpf: Extract the bpf_jit_binary_hdr helper

[Pu Lehui]

From: Pu Lehui <pulehui@huawei.com>

Extract the bpf_jit_binary_hdr helper, and wire it up to
bpf_jit_free function in JITs.

Signed-off-by: Pu Lehui <pulehui@huawei.com>
---
 include/linux/filter.h | 2 ++
 kernel/bpf/core.c      | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/linux/filter.h b/include/linux/filter.h
index 32d5297c557e..5d7fc70bd332 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1338,6 +1338,8 @@ void bpf_jit_free_exec(void *addr);
 void bpf_jit_free(struct bpf_prog *fp);
 struct bpf_binary_header *
 bpf_jit_binary_pack_hdr(const struct bpf_prog *fp);
+struct bpf_binary_header *
+bpf_jit_binary_hdr(const struct bpf_prog *fp);
 
 void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns, bool was_classic);
 void bpf_prog_pack_free(void *ptr, u32 size);
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index e2076667b245..27993ae1ac54 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1286,7 +1286,7 @@ bpf_jit_binary_pack_hdr(const struct bpf_prog *fp)
 	return (void *)addr;
 }
 
-static inline struct bpf_binary_header *
+struct bpf_binary_header *
 bpf_jit_binary_hdr(const struct bpf_prog *fp)
 {
 	unsigned long real_start = (unsigned long)fp->bpf_func;
-- 
2.34.1

[PATCH bpf-next v3 2/9] s390/bpf: Fix memory leak in bpf_jit_free

[Pu Lehui]

From: Pu Lehui <pulehui@huawei.com>

If a subprogram fails to JIT in jit_subprogs(), previously JITed
subprograms are freed. However, the generic bpf_jit_free() fails to
free their leftover jit_data, causing a memory leak.

Implement a custom bpf_jit_free() to free this data.

Fixes: 1c8f9b91c456 ("bpf: s390: add JIT support for multi-function programs")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
---
 arch/s390/net/bpf_jit_comp.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index b60877478b45..bf100e794e27 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -3106,3 +3106,22 @@ bool bpf_jit_inlines_helper_call(s32 imm)
 		return false;
 	}
 }
+
+void bpf_jit_free(struct bpf_prog *fp)
+{
+	if (fp->jited) {
+		struct s390_jit_data *jit_data = fp->aux->jit_data;
+		struct bpf_binary_header *hdr = bpf_jit_binary_hdr(fp);
+
+		/* Cleanup for earlier subprogs if jit_subprogs() aborts */
+		if (jit_data) {
+			kvfree(jit_data->ctx.addrs);
+			kfree(jit_data);
+		}
+
+		bpf_jit_binary_free(hdr);
+		WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(fp));
+	}
+
+	bpf_prog_unlock_free(fp);
+}
-- 
2.34.1

[PATCH bpf-next v3 3/9] parisc: Fix memory leak in bpf_jit_free

[Pu Lehui]

From: Pu Lehui <pulehui@huawei.com>

If a subprogram fails to JIT in jit_subprogs(), previously JITed
subprograms are freed. However, the generic bpf_jit_free() fails to
free their leftover jit_data, causing a memory leak.

Implement a custom bpf_jit_free() to free this data.

Fixes: 22de5d626231 ("parisc: Add eBPF JIT compiler glue code and Makefile")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
---
 arch/parisc/net/bpf_jit_core.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/arch/parisc/net/bpf_jit_core.c b/arch/parisc/net/bpf_jit_core.c
index 172770132440..ef63c38bdf15 100644
--- a/arch/parisc/net/bpf_jit_core.c
+++ b/arch/parisc/net/bpf_jit_core.c
@@ -178,6 +178,25 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 	goto out_offset;
 }
 
+void bpf_jit_free(struct bpf_prog *fp)
+{
+	if (fp->jited) {
+		struct hppa_jit_data *jit_data = fp->aux->jit_data;
+		struct bpf_binary_header *hdr = bpf_jit_binary_hdr(fp);
+
+		/* Cleanup for earlier subprogs if jit_subprogs() aborts */
+		if (jit_data) {
+			kfree(jit_data->ctx.offset);
+			kfree(jit_data);
+		}
+
+		bpf_jit_binary_free(hdr);
+		WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(fp));
+	}
+
+	bpf_prog_unlock_free(fp);
+}
+
 u64 hppa_div64(u64 div, u64 divisor)
 {
 	div = div64_u64(div, divisor);
-- 
2.34.1

Re: [PATCH bpf-next v3 3/9] parisc: Fix memory leak in bpf_jit_free

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Pre-existing memory leak of the allocated JIT image (`jit_data->header`) in `bpf_int_jit_compile()` if `build_body()` fails during an iteration after the image is allocated.
--

--- Patch [3]: [PATCH bpf-next v3 3/9] parisc: Fix memory leak in bpf_jit_free ---
commit 91fdce2769b7bfc645bd4e9356cd152dd1568159
Author: Pu Lehui <pulehui@huawei.com>

parisc: Fix memory leak in bpf_jit_free

If a subprogram fails to JIT in jit_subprogs(), previously JITed
subprograms are freed. However, the generic bpf_jit_free() fails to
free their leftover jit_data, causing a memory leak.

> diff --git a/arch/parisc/net/bpf_jit_core.c b/arch/parisc/net/bpf_jit_core.c
> index 172770132440d..ef63c38bdf151 100644
> --- a/arch/parisc/net/bpf_jit_core.c
> +++ b/arch/parisc/net/bpf_jit_core.c
> @@ -178,6 +178,25 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
>  	goto out_offset;
>  }

[Severity: High]
This is a pre-existing issue, but does bpf_int_jit_compile() leak
jit_data->header on some error paths?

Looking at bpf_int_jit_compile(), if build_body() fails during an iteration
after the image is allocated:

	for (i = 0; i < NR_JIT_ITERATIONS; i++) {
		...
		if (build_body(ctx, extra_pass, ctx->offset))
			goto out_err;
		...
		if (ctx->ninsns == prev_ninsns) {
			if (jit_data->header)
				break;
			...
			jit_data->header = bpf_jit_binary_alloc(...);

The code jumps to out_err, which falls through to out_offset (seen above):

out_err:
	if (extra_pass) {
		...
	}
	goto out_offset;

However, the out_offset cleanup block only frees ctx->offset and jit_data,
and skips freeing the already allocated jit_data->header:

out_offset:
		kfree(ctx->offset);
		kfree(jit_data);
		prog->aux->jit_data = NULL;

Could this lead to a memory leak of the JIT image buffer?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725154915.2488611-1-pulehui@huaweicloud.com?part=3

[PATCH bpf-next v3 4/9] bpf, sparc64: Fix memory leak in bpf_jit_free

[Pu Lehui]

From: Pu Lehui <pulehui@huawei.com>

If a subprogram fails to JIT in jit_subprogs(), previously JITed
subprograms are freed. However, the generic bpf_jit_free() fails to
free their leftover jit_data, causing a memory leak.

Implement a custom bpf_jit_free() to free this data.

Fixes: 5f5a64111639 ("bpf: sparc64: Add JIT support for multi-function programs.")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
---
 arch/sparc/net/bpf_jit_comp_64.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c
index 2fa0e9375127..b5892cdce711 100644
--- a/arch/sparc/net/bpf_jit_comp_64.c
+++ b/arch/sparc/net/bpf_jit_comp_64.c
@@ -1611,3 +1611,22 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 	}
 	goto out_off;
 }
+
+void bpf_jit_free(struct bpf_prog *fp)
+{
+	if (fp->jited) {
+		struct sparc64_jit_data *jit_data = fp->aux->jit_data;
+		struct bpf_binary_header *hdr = bpf_jit_binary_hdr(fp);
+
+		/* Cleanup for earlier subprogs if jit_subprogs() aborts */
+		if (jit_data) {
+			kfree(jit_data->ctx.offset);
+			kfree(jit_data);
+		}
+
+		bpf_jit_binary_free(hdr);
+		WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(fp));
+	}
+
+	bpf_prog_unlock_free(fp);
+}
-- 
2.34.1

[PATCH bpf-next v3 5/9] ARC, bpf: Fix memory leak in bpf_jit_free

[Pu Lehui]

From: Pu Lehui <pulehui@huawei.com>

If a subprogram fails to JIT in jit_subprogs(), previously JITed
subprograms are freed. However, the generic bpf_jit_free() fails to
free their leftover jit_data, causing a memory leak.

Implement a custom bpf_jit_free() to free this data.

Fixes: f122668ddcce ("ARC: Add eBPF JIT support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
---
 arch/arc/net/bpf_jit_core.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/arch/arc/net/bpf_jit_core.c b/arch/arc/net/bpf_jit_core.c
index 639a2736f029..29c8933e2dd2 100644
--- a/arch/arc/net/bpf_jit_core.c
+++ b/arch/arc/net/bpf_jit_core.c
@@ -1412,3 +1412,22 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 
 	return prog;
 }
+
+void bpf_jit_free(struct bpf_prog *fp)
+{
+	if (fp->jited) {
+		struct arc_jit_data *jit_data = fp->aux->jit_data;
+		struct bpf_binary_header *hdr = bpf_jit_binary_hdr(fp);
+
+		/* Cleanup for earlier subprogs if jit_subprogs() aborts */
+		if (jit_data) {
+			kfree(jit_data->bpf2insn);
+			kfree(jit_data);
+		}
+
+		bpf_jit_binary_free(hdr);
+		WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(fp));
+	}
+
+	bpf_prog_unlock_free(fp);
+}
-- 
2.34.1

[PATCH bpf-next v3 6/9] bpf, arm64: Fix memory leak in bpf_jit_free

[Pu Lehui]

From: Pu Lehui <pulehui@huawei.com>

When bpf_int_jit_compile() is called for subprograms, it returns early
during the first pass (!prog->is_func || extra_pass is false), keeping
ctx->offset alive for the subsequent extra pass.

If JIT compilation fails for a later subprogram, the BPF core aborts and
calls bpf_jit_free() to clean up the first subprogram. However,
bpf_jit_free() fails to free jit_data->ctx.offset, which causes a memory
leak of the JIT context offsets array.

Fix this by adding the missing kvfree(jit_data->ctx.offset) in
bpf_jit_free().

Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Acked-by: Xu Kuohai <xukuohai@huawei.com>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
---
 arch/arm64/net/bpf_jit_comp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 4cdc7dfb05ba..f4e4d4578e38 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -3237,6 +3237,7 @@ void bpf_jit_free(struct bpf_prog *prog)
 		 */
 		if (jit_data) {
 			bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
+			kvfree(jit_data->ctx.offset);
 			kfree(jit_data);
 		}
 		prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset();
-- 
2.34.1

Re: [PATCH bpf-next v3 6/9] bpf, arm64: Fix memory leak in bpf_jit_free

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

Pre-existing issues:
- [Critical] `bpf_jit_free()` ignores the return value of `bpf_jit_binary_pack_finalize()`, leading to a Use-After-Free and Double Free if finalization fails.
- [High] Pre-existing percpu memory leak of `priv_stack_ptr` on BPF JIT compilation failure.
- [High] The identical memory leak of `ctx.offset` fixed by this patch in ARM64 remains unfixed in the LoongArch BPF JIT compiler.
--

--- Patch [6]: [PATCH bpf-next v3 6/9] bpf, arm64: Fix memory leak in bpf_jit_free ---
commit c1be108f68505531829d01d1fddc5f23ead947da
Author: Pu Lehui <pulehui@huawei.com>

bpf, arm64: Fix memory leak in bpf_jit_free

When JIT compilation fails for a subprogram, the BPF core cleans up
previously compiled subprograms by calling bpf_jit_free(). This commit adds
a missing kvfree(jit_data->ctx.offset) to bpf_jit_free() in ARM64,
preventing a memory leak of the JIT context offsets array.

> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> index 4cdc7dfb05ba9..f4e4d4578e38a 100644
> --- a/arch/arm64/net/bpf_jit_comp.c
> +++ b/arch/arm64/net/bpf_jit_comp.c
> @@ -3237,6 +3237,7 @@ void bpf_jit_free(struct bpf_prog *prog)

[Severity: High]
This isn't a bug introduced by this patch, but is there a pre-existing
percpu memory leak of priv_stack_ptr when JIT compilation fails?

Looking at bpf_int_jit_compile() when build_body() fails, out_free_hdr frees
ro_header but does not set it to NULL. In the out_off block:

arch/arm64/net/bpf_jit_comp.c:bpf_int_jit_compile() {
    ...
    if (!ro_header && priv_stack_ptr) {
        free_percpu(priv_stack_ptr);
        prog->aux->priv_stack_ptr = NULL;
    }
    ...
}

Because ro_header is a dangling pointer, this check evaluates to false,
skipping the free. Later, when the BPF core aborts and calls
bpf_jit_free(prog), prog->jited is 0:

arch/arm64/net/bpf_jit_comp.c:bpf_jit_free() {
    if (prog->jited) {
        ...
    }
    ...
}

This skips the cleanup block entirely, leaving priv_stack_ptr permanently
leaked. Would it be appropriate to address this as well?

>  		 */
>  		if (jit_data) {
>  			bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);

[Severity: Critical]
This is a pre-existing issue, but could ignoring the return value of
bpf_jit_binary_pack_finalize() here lead to a use-after-free and double free?

If bpf_arch_text_copy() fails during finalization,
bpf_jit_binary_pack_finalize() frees the ro_header internally and returns an
error:

kernel/bpf/core.c:bpf_jit_binary_pack_finalize() {
    ...
    if (IS_ERR(ptr)) {
        bpf_prog_pack_free(ro_header, ro_header->size);
        return PTR_ERR(ptr);
    }
    ...
}

Since bpf_jit_free() ignores this error, it proceeds to retrieve the freed
header and unconditionally frees it again:

arch/arm64/net/bpf_jit_comp.c:bpf_jit_free() {
    ...
    prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset();
    hdr = bpf_jit_binary_pack_hdr(prog);
    bpf_jit_binary_pack_free(hdr, NULL);
}

Inside bpf_jit_binary_pack_free(), it reads ro_header->size (use-after-free)
and calls bpf_prog_pack_free() on it again (double free). Can this cause
memory corruption?

> +			kvfree(jit_data->ctx.offset);

[Severity: High]
This isn't a bug introduced by this patch, but does the LoongArch BPF JIT
compiler suffer from this exact same memory leak?

Looking at the LoongArch implementation, it uses the same multi-pass logic
for subprograms and preserves ctx.offset in jit_data. However, its
bpf_jit_free() does not free ctx.offset:

arch/loongarch/net/bpf_jit.c:bpf_jit_free() {
    ...
    if (jit_data) {
        bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
        kfree(jit_data);
    }
    ...
}

Should a similar kvfree() be added to arch/loongarch/net/bpf_jit.c?

>  			kfree(jit_data);
>  		}
>  		prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset();

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725154915.2488611-1-pulehui@huaweicloud.com?part=6

[PATCH bpf-next v3 7/9] bpf, arm64: Fix private stack leak when JIT failed

[Pu Lehui]

From: Pu Lehui <pulehui@huawei.com>

When bpf_int_jit_compile fails after allocating the private stack and
ro_header, it jumps to out_free_hdr where bpf_jit_binary_pack_free frees
ro_header but leaves the pointer non-NULL. This causes the subsequent
`if (!ro_header && priv_stack_ptr)` check at out_off to evaluate to
false, skipping free_percpu(priv_stack_ptr) and leaking the private
stack memory.

Fix this by setting ro_header to NULL after freeing it in out_free_hdr.

Fixes: 6c17a882d380 ("bpf, arm64: JIT support for private stack")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
---
 arch/arm64/net/bpf_jit_comp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index f4e4d4578e38..6e036acf80d8 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -2311,6 +2311,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 		bpf_arch_text_copy(&ro_header->size, &header->size,
 				   sizeof(header->size));
 		bpf_jit_binary_pack_free(ro_header, header);
+		ro_header = NULL;
 	}
 	goto out_off;
 }
-- 
2.34.1

Re: [PATCH bpf-next v3 7/9] bpf, arm64: Fix private stack leak when JIT failed

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Memory leak of the BPF private stack in the PowerPC JIT compiler upon JIT failure.
--

--- Patch [7]: [PATCH bpf-next v3 7/9] bpf, arm64: Fix private stack leak when JIT failed ---
commit 8de8b0f7fc232dba7540d3099301a4c55f3544c0
Author: Pu Lehui <pulehui@huawei.com>

bpf, arm64: Fix private stack leak when JIT failed

This patch fixes a memory leak in the ARM64 BPF JIT compiler. When JIT
compilation fails, the private stack percpu memory was being leaked because
the cleanup check evaluated to false after a pointer was left dangling. The
fix sets the pointer to NULL to ensure proper cleanup.

> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
> index f4e4d4578e38a..6e036acf80d8b 100644
> --- a/arch/arm64/net/bpf_jit_comp.c
> +++ b/arch/arm64/net/bpf_jit_comp.c
> @@ -2311,6 +2311,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
>  		bpf_arch_text_copy(&ro_header->size, &header->size,
>  				   sizeof(header->size));
>  		bpf_jit_binary_pack_free(ro_header, header);
> +		ro_header = NULL;

[Severity: Medium]
This is a pre-existing issue, but while fixing this memory leak for arm64,
it appears that the PowerPC JIT compiler has the exact same problem.

In arch/powerpc/net/bpf_jit_comp.c:bpf_int_jit_compile():

		if (bpf_jit_build_body(fp, code_base, fcode_base, &cgctx, addrs, pass,
				       extra_pass)) {
			bpf_arch_text_copy(&fhdr->size, &hdr->size, sizeof(hdr->size));
			bpf_jit_binary_pack_free(fhdr, hdr);
			goto out_err;
		}

When jumping to the error cleanup path, the JIT binary is freed but the image
pointer remains non-NULL.

Then in the cleanup path:

out_addrs:
		if (!image && priv_stack_ptr) {
			fp->aux->priv_stack_ptr = NULL;
			free_percpu(priv_stack_ptr);
		}

Because the image pointer is still non-NULL, this check evaluates to false.
Can this also cause the private stack percpu memory to be leaked in the
PowerPC JIT? Should a similar fix be applied there?

>  	}
>  	goto out_off;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725154915.2488611-1-pulehui@huaweicloud.com?part=7

[PATCH bpf-next v3 8/9] riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free

[Pu Lehui]

From: Pu Lehui <pulehui@huawei.com>

When CFI is enabled, the actual BPF program entry point is shifted
forward by a CFI preamble. During bpf_jit_free(), this shifted pointer
causes the wrong ro_header to be fetched, leading to a potential invalid
memory free.

Fix this by subtracting cfi_get_offset() from prog->bpf_func to
correctly restore the original JITed allocation address before freeing.

Fixes: e63985ecd226 ("bpf, riscv64/cfi: Support kCFI + BPF on riscv64")
Signed-off-by: Pu Lehui <pulehui@huawei.com>
---
 arch/riscv/net/bpf_jit_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
index cbfcd287ea16..059db1adeaf8 100644
--- a/arch/riscv/net/bpf_jit_core.c
+++ b/arch/riscv/net/bpf_jit_core.c
@@ -237,6 +237,7 @@ void bpf_jit_free(struct bpf_prog *prog)
 			kvfree(jit_data->ctx.offset);
 			kfree(jit_data);
 		}
+		prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset();
 		hdr = bpf_jit_binary_pack_hdr(prog);
 		bpf_jit_binary_pack_free(hdr, NULL);
 		WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(prog));
-- 
2.34.1

Re: [PATCH bpf-next v3 8/9] riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] bpf_jit_free() ignores the error return value of bpf_jit_binary_pack_finalize(), leading to a Use-After-Free and Double Free of the JIT ro_header.
--

--- Patch [8]: [PATCH bpf-next v3 8/9] riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free ---
commit a0a806deebfc4afdceb1a23fa093826ade44c8cf
Author: Pu Lehui <pulehui@huawei.com>

riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free

When CFI is enabled, the actual BPF program entry point is shifted forward
by a CFI preamble. This commit subtracts the CFI offset from prog->bpf_func
in bpf_jit_free() to restore the original JITed allocation address before
freeing it, preventing an invalid memory free.

> diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
> index cbfcd287ea166..059db1adeaf8d 100644
> --- a/arch/riscv/net/bpf_jit_core.c
> +++ b/arch/riscv/net/bpf_jit_core.c
> @@ -237,6 +237,7 @@ void bpf_jit_free(struct bpf_prog *prog)
>  			kvfree(jit_data->ctx.offset);
>  			kfree(jit_data);
>  		}
> +		prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset();
>  		hdr = bpf_jit_binary_pack_hdr(prog);
>  		bpf_jit_binary_pack_free(hdr, NULL);

[Severity: High]
This is a pre-existing issue, but does ignoring the return value of
bpf_jit_binary_pack_finalize() (called just prior to this diff snippet)
lead to a use-after-free and double free?

If bpf_jit_binary_pack_finalize() fails, it frees ro_header internally:

kernel/bpf/core.c:bpf_jit_binary_pack_finalize() {
    ...
    if (IS_ERR(ptr)) {
        bpf_prog_pack_free(ro_header, ro_header->size);
        return PTR_ERR(ptr);
    }
    ...
}

Back in bpf_jit_free(), we ignore this failure, extract the same freed
header via bpf_jit_binary_pack_hdr(), and call bpf_jit_binary_pack_free()
which dereferences ro_header->size and frees it again:

kernel/bpf/core.c:bpf_jit_binary_pack_free() {
    u32 size = ro_header->size;

    bpf_prog_pack_free(ro_header, size);
    ...
}

Should bpf_jit_free() check if bpf_jit_binary_pack_finalize() returned
an error before attempting to extract and free the header again?

>  		WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(prog));

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725154915.2488611-1-pulehui@huaweicloud.com?part=8

[PATCH bpf-next v3 9/9] bpf: Fix double-free RO header in bpf_jit_free

[Pu Lehui]

From: Pu Lehui <pulehui@huawei.com>

When bpf_jit_binary_pack_finalize fails in bpf_jit_free, it implicitly
frees ro_header. However, JITs are unaware of this. They extract and
free it again, leading to double-free issue.

bpf_jit_free
  bpf_jit_binary_pack_finalize(ro_header, rw_header)
    ptr = bpf_arch_text_copy(ro_header, rw_header, rw_header->size);
    kvfree(rw_header);
    if (IS_ERR(ptr)) { <-- copy failed
      bpf_prog_pack_free(ro_header, ro_header->size); <-- first free ro_header
      return PTR_ERR(ptr);
    }
  hdr = bpf_jit_binary_pack_hdr(prog); <-- fetch ro_header
  bpf_jit_binary_pack_free(hdr, NULL); <-- double free ro_header

Fix this by dropping the implicit free in bpf_jit_binary_pack_finalize.
Accordingly, adapt the JITs to explicitly handle freeing ro_header in
their error paths. This also fixes the missing memory uncharge upon
failure, as bpf_prog_pack_free does not uncharge.

Additionally, initialize ro_header->size in bpf_jit_binary_pack_alloc to
ensures ro_header->size is always valid during free, and remove
unnecessary bpf_arch_text_copy in JITs.

Fixes: 1d5f82d9dd47 ("bpf, x86: fix freeing of not-finalized bpf_prog_pack")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>
---
 arch/arm64/net/bpf_jit_comp.c   |  4 +---
 arch/loongarch/net/bpf_jit.c    |  6 ++----
 arch/powerpc/net/bpf_jit_comp.c |  5 +++--
 arch/riscv/net/bpf_jit_core.c   |  7 ++-----
 arch/x86/net/bpf_jit_comp.c     |  7 ++-----
 kernel/bpf/core.c               | 17 +++++++++--------
 6 files changed, 19 insertions(+), 27 deletions(-)

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 6e036acf80d8..32780247305e 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -2258,7 +2258,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 			goto out_free_hdr;
 		}
 		if (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) {
-			/* ro_header and header has been freed */
+			bpf_jit_binary_pack_free(ro_header, NULL);
 			ro_header = NULL;
 			header = NULL;
 			goto out_free_hdr;
@@ -2308,8 +2308,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 		prog->jited_len = 0;
 	}
 	if (header) {
-		bpf_arch_text_copy(&ro_header->size, &header->size,
-				   sizeof(header->size));
 		bpf_jit_binary_pack_free(ro_header, header);
 		ro_header = NULL;
 	}
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index 2738b4db1165..48ad418df133 100644
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -2298,7 +2298,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 			goto out_free;
 		}
 		if (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) {
-			/* ro_header and header have been freed */
+			bpf_jit_binary_pack_free(ro_header, NULL);
 			ro_header = NULL;
 			header = NULL;
 			goto out_free;
@@ -2341,10 +2341,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 		prog->jited_len = 0;
 	}
 
-	if (header) {
-		bpf_arch_text_copy(&ro_header->size, &header->size, sizeof(header->size));
+	if (header)
 		bpf_jit_binary_pack_free(ro_header, header);
-	}
 	goto out_offset;
 }
 
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 7b07b43575f1..ff9bcd55165b 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -314,7 +314,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 		bpf_jit_build_prologue(code_base, &cgctx);
 		if (bpf_jit_build_body(fp, code_base, fcode_base, &cgctx, addrs, pass,
 				       extra_pass)) {
-			bpf_arch_text_copy(&fhdr->size, &hdr->size, sizeof(hdr->size));
 			bpf_jit_binary_pack_free(fhdr, hdr);
 			goto out_err;
 		}
@@ -339,8 +338,10 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 #endif
 
 	if (!fp->is_func || extra_pass) {
-		if (bpf_jit_binary_pack_finalize(fhdr, hdr))
+		if (bpf_jit_binary_pack_finalize(fhdr, hdr)) {
+			bpf_jit_binary_pack_free(fhdr, NULL);
 			goto out_err;
+		}
 	}
 
 	fp->bpf_func = (void *)fimage;
diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
index 059db1adeaf8..55530e80df2e 100644
--- a/arch/riscv/net/bpf_jit_core.c
+++ b/arch/riscv/net/bpf_jit_core.c
@@ -154,7 +154,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 
 	if (!prog->is_func || extra_pass) {
 		if (WARN_ON(bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header))) {
-			/* ro_header has been freed */
+			bpf_jit_binary_pack_free(jit_data->ro_header, NULL);
 			jit_data->ro_header = NULL;
 			jit_data->header = NULL;
 			goto out_free_hdr;
@@ -183,11 +183,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 		prog->jited = 0;
 		prog->jited_len = 0;
 	}
-	if (jit_data->header) {
-		bpf_arch_text_copy(&jit_data->ro_header->size, &jit_data->header->size,
-				   sizeof(jit_data->header->size));
+	if (jit_data->header)
 		bpf_jit_binary_pack_free(jit_data->ro_header, jit_data->header);
-	}
 	goto out_offset;
 }
 
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index b2feec81e231..281e89764d98 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -3930,11 +3930,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 		if (proglen <= 0) {
 out_image:
 			image = NULL;
-			if (header) {
-				bpf_arch_text_copy(&header->size, &rw_header->size,
-						   sizeof(rw_header->size));
+			if (header)
 				bpf_jit_binary_pack_free(header, rw_header);
-			}
 			if (extra_pass) {
 				prog->bpf_func = NULL;
 				prog->jited = 0;
@@ -3987,7 +3984,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 			 * Both cases are serious bugs and justify WARN_ON.
 			 */
 			if (WARN_ON(bpf_jit_binary_pack_finalize(header, rw_header))) {
-				/* header has been freed */
+				bpf_jit_binary_pack_free(header, NULL);
 				header = NULL;
 				goto out_image;
 			}
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 27993ae1ac54..8d3528311f8e 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1218,6 +1218,13 @@ bpf_jit_binary_pack_alloc(unsigned int proglen, u8 **image_ptr,
 		return NULL;
 	}
 
+	/* Initialize ro_header->size to ensure it is valid during free */
+	if (IS_ERR(bpf_arch_text_copy(&ro_header->size, &size, sizeof(size)))) {
+		bpf_prog_pack_free(ro_header, size);
+		bpf_jit_uncharge_modmem(size);
+		return NULL;
+	}
+
 	*rw_header = kvmalloc(size, GFP_KERNEL);
 	if (!*rw_header) {
 		bpf_prog_pack_free(ro_header, size);
@@ -1249,10 +1256,9 @@ int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header,
 
 	kvfree(rw_header);
 
-	if (IS_ERR(ptr)) {
-		bpf_prog_pack_free(ro_header, ro_header->size);
+	if (IS_ERR(ptr))
 		return PTR_ERR(ptr);
-	}
+
 	return 0;
 }
 
@@ -1260,11 +1266,6 @@ int bpf_jit_binary_pack_finalize(struct bpf_binary_header *ro_header,
  *   1) when the program is freed after;
  *   2) when the JIT engine fails (before bpf_jit_binary_pack_finalize).
  * For case 2), we need to free both the RO memory and the RW buffer.
- *
- * bpf_jit_binary_pack_free requires proper ro_header->size. However,
- * bpf_jit_binary_pack_alloc does not set it. Therefore, ro_header->size
- * must be set with either bpf_jit_binary_pack_finalize (normal path) or
- * bpf_arch_text_copy (when jit fails).
  */
 void bpf_jit_binary_pack_free(struct bpf_binary_header *ro_header,
 			      struct bpf_binary_header *rw_header)
-- 
2.34.1