Re: [PATCH bpf-next v3 6/9] bpf: keep module BTF until the vmlinux BTF is available

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] bpf: memory leak of module BTF data on parse failure for .BTF.base modules
--

commit 10719f6f8154699a27d9151dc131b89e1ea34139
Author: Jay Wang <wanjay@amazon.com>

    bpf: keep module BTF until the vmlinux BTF is available
    
    Module BTF is split BTF against the vmlinux BTF and is parsed in the
    module notifier.  With CONFIG_DEBUG_INFO_BTF=m the vmlinux BTF may not be
    loaded yet when a module loads, and the notifier cannot load btf_vmlinux
    (that would nest a module load in a module load).

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 207954b5754a7..1dae1c9b53fed 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
[ ... ]
> @@ -9309,6 +9414,101 @@ static int __init btf_module_init(void)
>  }
>  
>  fs_initcall(btf_module_init);
> +
> +#if IS_MODULE(CONFIG_DEBUG_INFO_BTF)
> +/*
> + * A kept module whose BTF cannot be used after all.  The module is loaded
> + * and stays, so there is no way to reject it: the entry stays on the list,
> + * dead, until the module goes.  A sysfs file it has keeps serving the raw
> + * data, which is kept for that.
> + */
> +static void btf_module_dead(struct btf_module *btf_mod, const char *what, int err)
> +{
> +	pr_warn("failed to %s module [%s] BTF: %d\n", what, btf_mod->module->name, err);
> +	kvfree(btf_mod->base_data);
> +	btf_mod->base_data = NULL;
> +	btf_free_deferred_regs(&btf_mod->deferred_regs);
> +	btf_mod->gone = true;
> +}

[Severity: Low]
Does this code leak btf_mod->data when parsing fails for modules with a
.BTF.base section?

If a module with a .BTF.base section is loaded before the vmlinux BTF, and its
deferred BTF parsing subsequently fails when the vmlinux BTF is loaded, the
memory btf_mod->data is retained because btf_module_dead() assumes the sysfs
file will continue to serve the raw data.

However, for .BTF.base modules, the sysfs file uses
btf_module_sysfs_read_deferred(), which returns -ENODEV when the module is
marked as gone. As a result, the memory is inaccessible and uselessly retained
until the module is unloaded.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925224229.1850-1-wanjay@amazon.com?part=6