[PATCH] selftests/bpf: Fix memory leak in msg_alloc_iov error path

[PATCH] selftests/bpf: Fix memory leak in msg_alloc_iov error path

[Malaya Kumar Rout]

In msg_alloc_iov(), when calloc() fails for an individual iov_base
allocation, the error path frees all previously allocated iov_base
entries but fails to free the iov array itself that was allocated
with calloc() at the beginning of the function. This results in a
memory leak of the iov array.

Add free(iov) in the unwind_iov error path to ensure proper cleanup
of all allocated memory.

Fixes: 16962b2404ac ("bpf: sockmap, add selftests")
Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com>
---
 tools/testing/selftests/bpf/test_sockmap.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
index ac814eb63edb..3e6be455d158 100644
--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -436,6 +436,7 @@ static int msg_alloc_iov(struct msghdr *msg,
 unwind_iov:
 	for (i--; i >= 0 ; i--)
 		free(msg->msg_iov[i].iov_base);
+	free(iov);
 	return -ENOMEM;
 }
 
-- 
2.54.0

Re: [PATCH] selftests/bpf: Fix memory leak in msg_alloc_iov error path

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1455 bytes --]

>     selftests/bpf: Fix memory leak in msg_alloc_iov error path
>
>     In msg_alloc_iov(), when calloc() fails for an individual iov_base
>     allocation, the error path frees all previously allocated iov_base
>     entries but fails to free the iov array itself that was allocated
>     with calloc() at the beginning of the function. This results in a
>     memory leak of the iov array.
>
>     Add free(iov) in the unwind_iov error path to ensure proper cleanup
>     of all allocated memory.
>
>     Fixes: 16962b2404ac ("bpf: sockmap, add selftests")
>     Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com>

Is the Fixes: tag pointing at the right commit?

In 16962b2404ac ("bpf: sockmap, add selftests") the iov allocation lived
inside msg_loop(), and its out_errno error path already freed the iov
array with free(iov).  There was no msg_alloc_iov() helper and no
unwind_iov label at that point.

The leaking unwind_iov path was introduced later, when the allocation was
refactored into the new msg_alloc_iov() helper whose unwind_iov label
frees each iov_base entry but omits free(iov).  Would this be a better
match?

  Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/28704662518

[PATCH v2] selftests/bpf: Fix memory leak in msg_alloc_iov error path

[Malaya Kumar Rout]

In msg_alloc_iov(), when calloc() fails for an individual iov_base
allocation, the error path frees all previously allocated iov_base
entries but fails to free the iov array itself that was allocated
with calloc() at the beginning of the function. This results in a
memory leak of the iov array.

Add free(iov) in the unwind_iov error path to ensure proper cleanup
of all allocated memory.

Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap")
Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com>
---
 tools/testing/selftests/bpf/test_sockmap.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
index ac814eb63edb..3e6be455d158 100644
--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -436,6 +436,7 @@ static int msg_alloc_iov(struct msghdr *msg,
 unwind_iov:
 	for (i--; i >= 0 ; i--)
 		free(msg->msg_iov[i].iov_base);
+	free(iov);
 	return -ENOMEM;
 }
 
-- 
2.54.0

Re: [PATCH v2] selftests/bpf: Fix memory leak in msg_alloc_iov error path

[Emil Tsalapatis]

On Sat Jul 4, 2026 at 8:29 AM EDT, Malaya Kumar Rout wrote:
> In msg_alloc_iov(), when calloc() fails for an individual iov_base
> allocation, the error path frees all previously allocated iov_base
> entries but fails to free the iov array itself that was allocated
> with calloc() at the beginning of the function. This results in a
> memory leak of the iov array.
>
> Add free(iov) in the unwind_iov error path to ensure proper cleanup
> of all allocated memory.
>
> Fixes: 753fb2ee0934 ("bpf: sockmap, add msg_peek tests to test_sockmap")
> Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com>

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

> ---
>  tools/testing/selftests/bpf/test_sockmap.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
> index ac814eb63edb..3e6be455d158 100644
> --- a/tools/testing/selftests/bpf/test_sockmap.c
> +++ b/tools/testing/selftests/bpf/test_sockmap.c
> @@ -436,6 +436,7 @@ static int msg_alloc_iov(struct msghdr *msg,
>  unwind_iov:
>  	for (i--; i >= 0 ; i--)
>  		free(msg->msg_iov[i].iov_base);
> +	free(iov);
>  	return -ENOMEM;
>  }
>  

Re: [PATCH v2] selftests/bpf: Fix memory leak in msg_alloc_iov error path

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Kumar Kartikeya Dwivedi <memxor@gmail.com>:

On Sat,  4 Jul 2026 17:59:35 +0530 you wrote:
> In msg_alloc_iov(), when calloc() fails for an individual iov_base
> allocation, the error path frees all previously allocated iov_base
> entries but fails to free the iov array itself that was allocated
> with calloc() at the beginning of the function. This results in a
> memory leak of the iov array.
> 
> Add free(iov) in the unwind_iov error path to ensure proper cleanup
> of all allocated memory.
> 
> [...]

Here is the summary with links:
  - [v2] selftests/bpf: Fix memory leak in msg_alloc_iov error path
    https://git.kernel.org/bpf/bpf-next/c/07c1b07d3871

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html