Re: [PATCH bpf-next 2/4] LoongArch: BPF: Fix memory leak in bpf_jit_free

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch series correctly fixes a memory leak of `prog->aux->jit_data` on JIT subprogram failure in `arm64` and `loongarch`, but misses the identical architectural flaw in `s390`, `parisc`, and `sparc64`.
--

--- Patch [2]: [PATCH bpf-next 2/4] LoongArch: BPF: Fix memory leak in bpf_jit_free ---
commit cacb56acd5af4ef394049dd1560a358cf9a04bae
Author: Pu Lehui <pulehui@huawei.com>

LoongArch: BPF: Fix memory leak in bpf_jit_free

This commit fixes a memory leak in the LoongArch BPF JIT compiler. When
bpf_int_jit_compile() returns early for subprograms, it leaves ctx->offset
allocated, which bpf_jit_free() previously failed to clean up on abort.

> diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
> index 2738b4db11653..3d3ed1677d018 100644
> --- a/arch/loongarch/net/bpf_jit.c
> +++ b/arch/loongarch/net/bpf_jit.c
> @@ -2361,6 +2361,7 @@ void bpf_jit_free(struct bpf_prog *prog)
>  		 */
>  		if (jit_data) {
>  			bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
> +			kvfree(jit_data->ctx.offset);
>  			kfree(jit_data);
>  		}

[Severity: High]
This is a pre-existing issue, but while this patch correctly fixes the memory
leak of the JIT context arrays for LoongArch, do we have the exact same leak
occurring in s390, parisc, and sparc64?

Looking at s390, parisc, and sparc64, they also return early for subprograms
and leave memory attached to prog->aux->jit_data. For example, in s390:

arch/s390/net/bpf_jit_comp.c:bpf_int_jit_compile() {
    ...
    } else {
        jit_data->header = header;
        jit_data->ctx = jit;
        jit_data->pass = pass;
    }
    ...
    if (!fp->is_func || extra_pass) {
        ...
        kvfree(jit.addrs);
        kfree(jit_data);
        fp->aux->jit_data = NULL;
    }
}

However, these architectures do not have a custom bpf_jit_free() implementation
and rely on the weak generic bpf_jit_free() function instead:

kernel/bpf/core.c:bpf_jit_free() {
    if (fp->jited) {
        struct bpf_binary_header *hdr = bpf_jit_binary_hdr(fp);

        bpf_jit_binary_free(hdr);
        WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(fp));
    }

    bpf_prog_unlock_free(fp);
}

The generic bpf_jit_free() does not check or free prog->aux->jit_data. If JIT
compilation fails for a later subprogram, the BPF core aborts and calls
bpf_jit_free() on all previously JITed subprograms. 

Does this mean s390, parisc, and sparc64 will still leak their jit_data and
offset arrays on this failure path?

>  		hdr = bpf_jit_binary_pack_hdr(prog);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722112754.1615201-1-pulehui@huaweicloud.com?part=2