[PATCH] bpf: replace kvfree with kfree for kzalloc memory

[PATCH] bpf: replace kvfree with kfree for kzalloc memory

[Qianfeng Rong]

The 'backedge' pointer is allocated with kzalloc(), which returns
physically contiguous memory. Using kvfree() to deallocate such
memory is functionally safe but semantically incorrect.

Replace kvfree() with kfree() to avoid unnecessary is_vmalloc_addr()
check in kvfree().

Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
---
 kernel/bpf/verifier.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c4f69a9e9af6..4e5de1ff7e30 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -19553,7 +19553,7 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
 				err = err ?: add_scc_backedge(env, &sl->state, backedge);
 				if (err) {
 					free_verifier_state(&backedge->state, false);
-					kvfree(backedge);
+					kfree(backedge);
 					return err;
 				}
 			}
-- 
2.34.1

Re: [PATCH] bpf: replace kvfree with kfree for kzalloc memory

[Qianfeng Rong]

Hi all,

Sorry, please ignore this patch, because I found that there are still a 
lot of mixed uses of kfree and kvfree in kernel/bpf/verifier.c. Best 
regards, Qianfeng

Re: [PATCH] bpf: replace kvfree with kfree for kzalloc memory

[Markus Elfring]

…
> Replace kvfree() with kfree() to avoid unnecessary is_vmalloc_addr()
> check in kvfree().

Under which circumstances would you become interested to apply the attribute “__free”
(also in the affected if branch)?
https://elixir.bootlin.com/linux/v6.16/source/include/linux/slab.h#L476

Regards,
Markus

Re: [PATCH] bpf: replace kvfree with kfree for kzalloc memory

[Eduard Zingerman]

On Mon, 2025-08-11 at 20:39 +0800, Qianfeng Rong wrote:
> The 'backedge' pointer is allocated with kzalloc(), which returns
> physically contiguous memory. Using kvfree() to deallocate such
> memory is functionally safe but semantically incorrect.
> 
> Replace kvfree() with kfree() to avoid unnecessary is_vmalloc_addr()
> check in kvfree().
> 
> Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

>  kernel/bpf/verifier.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index c4f69a9e9af6..4e5de1ff7e30 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -19553,7 +19553,7 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
>  				err = err ?: add_scc_backedge(env, &sl->state, backedge);
>  				if (err) {
>  					free_verifier_state(&backedge->state, false);
> -					kvfree(backedge);
> +					kfree(backedge);

The backedge encapsulates verifier state, verifier states are
allocated using kzalloc() and freed using kfreed() in other places in
verifier.c => I think this patch is valid.

>  					return err;
>  				}
>  			}

Re: [PATCH] bpf: replace kvfree with kfree for kzalloc memory

[Eduard Zingerman]

On Mon, 2025-08-11 at 21:15 +0800, Qianfeng Rong wrote:
> Hi all,
> 
> Sorry, please ignore this patch, because I found that there are still a 
> lot of mixed uses of kfree and kvfree in kernel/bpf/verifier.c. Best 
> regards, Qianfeng

Using kvfree() in this position was sloppy on my side,
thank you for noticing this.

Re: [PATCH] bpf: replace kvfree with kfree for kzalloc memory

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Andrii Nakryiko <andrii@kernel.org>:

On Mon, 11 Aug 2025 20:39:49 +0800 you wrote:
> The 'backedge' pointer is allocated with kzalloc(), which returns
> physically contiguous memory. Using kvfree() to deallocate such
> memory is functionally safe but semantically incorrect.
> 
> Replace kvfree() with kfree() to avoid unnecessary is_vmalloc_addr()
> check in kvfree().
> 
> [...]

Here is the summary with links:
  - bpf: replace kvfree with kfree for kzalloc memory
    https://git.kernel.org/bpf/bpf-next/c/bf0c2a84df9f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

[PATCH] bpf: Replace kvfree with kfree for kzalloc memory

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

Refer to https://lore.kernel.org/bpf/20250811123949.552885-1-rongqianfeng@vivo.com to replace the remaining part.

Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
---
 kernel/bpf/verifier.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 5c9dd16b2c56..b9394f8fac0e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2021,7 +2021,7 @@ static void free_backedges(struct bpf_scc_visit *visit)
 	for (backedge = visit->backedges; backedge; backedge = next) {
 		free_verifier_state(&backedge->state, false);
 		next = backedge->next;
-		kvfree(backedge);
+		kfree(backedge);
 	}
 	visit->backedges = NULL;
 }
@@ -19651,7 +19651,7 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
 	err = maybe_enter_scc(env, new);
 	if (err) {
 		free_verifier_state(new, false);
-		kvfree(new_sl);
+		kfree(new_sl);
 		return err;
 	}
 
-- 
2.43.0

Re: [PATCH] bpf: Replace kvfree with kfree for kzalloc memory

[Daniel Borkmann]

On 8/26/25 9:39 AM, Feng Yang wrote:
> From: Feng Yang <yangfeng@kylinos.cn>
> 
> Refer to https://lore.kernel.org/bpf/20250811123949.552885-1-rongqianfeng@vivo.com to replace the remaining part.

Please make this a proper commit message instead of just posting a lore link.
$subj should be [PATCH bpf-next].

> Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
> ---
>   kernel/bpf/verifier.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 5c9dd16b2c56..b9394f8fac0e 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -2021,7 +2021,7 @@ static void free_backedges(struct bpf_scc_visit *visit)
>   	for (backedge = visit->backedges; backedge; backedge = next) {
>   		free_verifier_state(&backedge->state, false);
>   		next = backedge->next;
> -		kvfree(backedge);
> +		kfree(backedge);
>   	}
>   	visit->backedges = NULL;
>   }
> @@ -19651,7 +19651,7 @@ static int is_state_visited(struct bpf_verifier_env *env, int insn_idx)
>   	err = maybe_enter_scc(env, new);
>   	if (err) {
>   		free_verifier_state(new, false);
> -		kvfree(new_sl);
> +		kfree(new_sl);
>   		return err;
>   	}
>