Re: [PATCH RFC bpf-next 2/6] bpf: compute loops hierarchy

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf_compute_loops() incorrectly uses kfree() to free memory allocated with kvcalloc().
--

commit ef2f37474f7b031f628d088384c6723a83200838
Author: Eduard Zingerman <eddyz87@gmail.com>

bpf: compute loops hierarchy

This commit adds an analysis phase to the BPF verifier to compute the
loops hierarchy using a non-recursive algorithm. It records the loop
header per instruction and tracks loop irreducibility to provide better
callchain profiling.

> diff --git a/kernel/bpf/loops.c b/kernel/bpf/loops.c
> new file mode 100644
> index 0000000000000..4bbcd923e960a
> --- /dev/null
> +++ b/kernel/bpf/loops.c

[ ... ]

> +int bpf_compute_loops(struct bpf_verifier_env *env)
> +{
> +	struct bpf_insn_aux_data *aux = env->insn_aux_data;
> +	int i, err = 0, len = env->prog->len;
> +	struct loops_dfs dfs = {};
> +
> +	dfs.dfs_pos = kvcalloc(len, sizeof(int), GFP_KERNEL_ACCOUNT);
> +	dfs.state = kvcalloc(len, sizeof(struct dfs_state), GFP_KERNEL_ACCOUNT);
> +	dfs.stack = kvcalloc(len, sizeof(int), GFP_KERNEL_ACCOUNT);
> +	if (!dfs.dfs_pos || !dfs.state || !dfs.stack) {
> +		err = -ENOMEM;
> +		goto out;
> +	}

[ ... ]

> +out:
> +	kfree(dfs.dfs_pos);
> +	kfree(dfs.stack);
> +	kfree(dfs.state);

[Severity: High]
Should these be freed using kvfree() instead of kfree()?

Since these arrays are allocated using kvcalloc() and BPF programs can contain
up to 1 million instructions, the allocations can grow to several megabytes.
In such cases, kvcalloc() will fall back to vmalloc().

Calling kfree() on a vmalloc address will blindly call virt_to_page() for a
virtual address, which can lead to a kernel panic or slab corruption.

> +	return err;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260526-better-1m-reporting-v1-0-51e4f2c59780@gmail.com?part=2