Re: [PATCH bpf] bpf: potential double-free of env->insn_aux_data

[Eduard Zingerman <eddyz87@gmail.com>]

On Mon, 2025-09-15 at 13:42 +0200, Daniel Borkmann wrote:

[...]

> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 9fb1f957a09374e4d148402572b872bec930f34c..92eb0f4e87a4ec3a7e303c6949cb415e3fd0b4ac 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -20781,7 +20781,6 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of
> >   			verbose(env,
> >   				"insn %d cannot be patched due to 16-bit range\n",
> >   				env->insn_aux_data[off].orig_idx);
> > -		vfree(new_data);
> 
> I presume you mean bpf-next tree, otherwise we'd be adding a memory leak into bpf tree?

Hi Daniel,

Yes, the tag should be bpf-next.
Will resend with the correct tag.
I apologize, this was sloppy on my side.

[...]