Re: [PATCH bpf-next v5 2/6] riscv, bpf: Using kvzalloc_objs to allocate cache buffer

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `kvfree(jit_data->ctx.offset)` in `bpf_jit_free` causes a memory leak of the JIT context offsets when JIT compilation aborts during subprogram processing.
--

--- Patch [2]: [PATCH bpf-next v5 2/6] riscv, bpf: Using kvzalloc_objs to allocate cache buffer ---
commit a49923246dc7e8b492561a3a183fc88dc6914fa1
Author: Pu Lehui <pulehui@huawei.com>

riscv, bpf: Using kvzalloc_objs to allocate cache buffer

It is unnecessary to allocate continuous physical memory for cache
buffer, and when ebpf program is too large, it may cause memory
allocation failure.

> diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
> index ce3bd3762e08c..367ae923ea40c 100644
> --- a/arch/riscv/net/bpf_jit_core.c
> +++ b/arch/riscv/net/bpf_jit_core.c
> @@ -72,7 +72,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
>  	ctx->arena_vm_start = bpf_arena_get_kern_vm_start(prog->aux->arena);
>  	ctx->user_vm_start = bpf_arena_get_user_vm_start(prog->aux->arena);
>  	ctx->prog = prog;
> -	ctx->offset = kzalloc_objs(int, prog->len);
> +	ctx->offset = kvzalloc_objs(int, prog->len);

[Severity: High]
This is a pre-existing issue, but does this leak the ctx->offset array if JIT
compilation aborts during subprogram processing?

For subprograms during the first pass (!prog->is_func || extra_pass is false),
bpf_int_jit_compile() returns early, keeping ctx->offset alive for the
subsequent extra pass.

If a later subprogram fails JIT compilation, the BPF core aborts and calls
bpf_jit_free() to clean up the first subprogram:

arch/riscv/net/bpf_jit_core.c:bpf_jit_free() {
	...
		if (jit_data) {
			bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
			kfree(jit_data);
		}
	...
}

It appears jit_data->ctx.offset is not freed during this cleanup, which could
lead to a memory leak.

>  	if (!ctx->offset)
>  		goto out_offset;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707142219.2871758-1-pulehui@huaweicloud.com?part=2