Re: [PATCH v10 8/8] powerpc64/bpf: fix percpu private stack leak on JIT failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Percpu private stack memory is permanently leaked in ARM64 JIT on compilation error paths.
--

--- Patch [8]: [PATCH v10 8/8] powerpc64/bpf: fix percpu private stack leak on JIT failure ---
commit 04e1b164f2198ac765746ea52f6d89ebc5ed346a
Author: Abhishek Dubey <adubey@linux.ibm.com>

powerpc64/bpf: fix percpu private stack leak on JIT failure

This commit fixes a percpu memory leak in the powerpc64 BPF JIT compiler.
It ensures the private stack is properly freed on error paths by checking
if compilation succeeded, rather than relying on whether the image buffer
was allocated.

Closes: https://lore.kernel.org/bpf/20260616135426.A06B71F000E9@smtp.kernel.org

> diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
> index 3c20bb13cfd70..825999f8717bd 100644
> --- a/arch/powerpc/net/bpf_jit_comp.c
> +++ b/arch/powerpc/net/bpf_jit_comp.c
> @@ -404,7 +404,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
>  				(void *)fimage + FUNCTION_DESCR_SIZE);
>  
>  out_addrs:
> -		if (!image && priv_stack_ptr) {
> +		if (!fp->jited && priv_stack_ptr) {
>  			fp->aux->priv_stack_ptr = NULL;
>  			free_percpu(priv_stack_ptr);
>  		}

[Severity: High]
This is a pre-existing issue, but does a similar memory leak exist in the
ARM64 BPF JIT error path?

Looking at bpf_int_jit_compile() in arch/arm64/net/bpf_jit_comp.c:

out_free_hdr:
        ...
        if (header) {
                bpf_arch_text_copy(&ro_header->size, &header->size,
                                   sizeof(header->size));
                bpf_jit_binary_pack_free(ro_header, header);
        }
        goto out_off;

out_off:
        if (!ro_header && priv_stack_ptr) {
                free_percpu(priv_stack_ptr);
                prog->aux->priv_stack_ptr = NULL;
        }

If the code jumps to out_free_hdr, ro_header is freed but not set to NULL.
When execution proceeds to out_off, the !ro_header check will evaluate to false.

Since prog->jited is also set to 0 on these error paths, bpf_jit_free() will
skip freeing the private stack as well.

Could this allow a user to deliberately trigger JIT failures (for example,
by hitting limits during passes) to repeatedly leak percpu memory and
exhaust the allocator?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1785906979.git.skb99@linux.ibm.com?part=8