[PATCH bpf-next v8 03/22] bpf: Do btf_record_free for outer maps

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

First of all, whenever btf_record_dup fails, we must free inner_map_meta
that was allocated before.

Secondly, outer maps are a bit different than normal maps, since they
don't have anything to free in the map values when being destructed. The
inner_map_meta that holds a duplicated btf_record (from the inner map fd
being used to parameterize the outer map) only exists to serve checks
during verification, which is why we never populate field_offs in
inner_map_meta. Hence, in this case, simply take ownership of the
duplicated btf_record and free it in bpf_map_meta_free.

This fixes both sources of leaks (in case of errors) during inner map
creation.

Fixes: aa3496accc41 ("bpf: Refactor kptr_off_tab into btf_record")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 kernel/bpf/map_in_map.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c
index 4caf03eb51ab..74f91048eee3 100644
--- a/kernel/bpf/map_in_map.c
+++ b/kernel/bpf/map_in_map.c
@@ -52,13 +52,20 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
 	inner_map_meta->max_entries = inner_map->max_entries;
 	inner_map_meta->record = btf_record_dup(inner_map->record);
 	if (IS_ERR(inner_map_meta->record)) {
+		struct bpf_map *err_ptr = ERR_CAST(inner_map_meta->record);
 		/* btf_record_dup returns NULL or valid pointer in case of
 		 * invalid/empty/valid, but ERR_PTR in case of errors. During
 		 * equality NULL or IS_ERR is equivalent.
 		 */
+		kfree(inner_map_meta);
 		fdput(f);
-		return ERR_CAST(inner_map_meta->record);
+		return err_ptr;
 	}
+	/* It is critical that inner_map btf is set to inner_map_meta btf, as
+	 * the duplicated btf_record's list_head btf_field structs have
+	 * value_rec members which point into the btf_record populated for the
+	 * map btf.
+	 */
 	if (inner_map->btf) {
 		btf_get(inner_map->btf);
 		inner_map_meta->btf = inner_map->btf;
@@ -78,6 +85,7 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
 
 void bpf_map_meta_free(struct bpf_map *map_meta)
 {
+	btf_record_free(map_meta->record);
 	btf_put(map_meta->btf);
 	kfree(map_meta);
 }
-- 
2.38.1